diff --git a/.github/actions/install-pinned-kotlin/action.yml b/.github/actions/install-pinned-kotlin/action.yml
new file mode 100644
index 0000000000..8b90ef149e
--- /dev/null
+++ b/.github/actions/install-pinned-kotlin/action.yml
@@ -0,0 +1,19 @@
+name: Install pinned Kotlin
+description: >
+  Installs a pinned Kotlin version and prepends it to the PATH.
+  Kotlin 2.3.20 and newer cannot execute the workflow scripts with the `kotlin` CLI,
+  because resolving extension functions from imported scripts is broken there,
+  see https://youtrack.jetbrains.com/issue/KT-86352.
+  As the GitHub runner images ship an affected version, this action puts an
+  unaffected version on the PATH before any workflow script is executed on a runner.
+
+runs:
+  using: "composite"
+  steps:
+    - name: 'Install Kotlin 2.3.10 (work-around for KT-86352)'
+      run: |
+        curl --fail --silent --show-error --location --output "$RUNNER_TEMP/kotlin-compiler.zip" "https://github.com/JetBrains/kotlin/releases/download/v2.3.10/kotlin-compiler-2.3.10.zip"
+        echo "c8d546f9ff433b529fb0ad43feceb39831040cae2ca8d17e7df46364368c9a9e  $RUNNER_TEMP/kotlin-compiler.zip" | sha256sum --check
+        unzip -q "$RUNNER_TEMP/kotlin-compiler.zip" -d "$RUNNER_TEMP/pinned-kotlin"
+        echo "$RUNNER_TEMP/pinned-kotlin/kotlinc/bin" >> "$GITHUB_PATH"
+      shell: bash
diff --git a/.github/workflows/branches-and-prs.main.kts b/.github/workflows/branches-and-prs.main.kts
index 85986aa6bf..c2acfb78c8 100755
--- a/.github/workflows/branches-and-prs.main.kts
+++ b/.github/workflows/branches-and-prs.main.kts
@@ -40,8 +40,6 @@ import io.github.typesafegithub.workflows.domain.triggers.Push
 import io.github.typesafegithub.workflows.dsl.expressions.Contexts.github
 import io.github.typesafegithub.workflows.dsl.expressions.expr
 import io.github.typesafegithub.workflows.dsl.workflow
-import io.github.typesafegithub.workflows.yaml.CheckoutActionVersionSource.InferFromClasspath
-import io.github.typesafegithub.workflows.yaml.DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG
 
 workflow(
     name = "Verify Branches and PRs",
@@ -61,9 +59,7 @@ workflow(
         group = "${expr { github.workflow }}-${expr("${github.eventPullRequest.pull_request.number} || ${github.ref}")}",
         cancelInProgress = true
     ),
-    consistencyCheckJobConfig = DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG.copy(
-        checkoutActionVersion = InferFromClasspath()
-    )
+    consistencyCheckJobConfig = commonConsistencyCheckJobConfig
 ) {
     job(
         id = "check_all_workflow_yaml_consistency",
@@ -74,6 +70,7 @@ workflow(
             name = "Checkout Repository",
             action = Checkout()
         )
+        installPinnedKotlin()
         run(
             name = "Regenerate all Workflow YAMLs",
             command = """find .github/workflows -mindepth 1 -maxdepth 1 -name '*.main.kts' -exec {} \;"""
diff --git a/.github/workflows/branches-and-prs.yaml b/.github/workflows/branches-and-prs.yaml
index 519640c84f..ffe9669d5f 100644
--- a/.github/workflows/branches-and-prs.yaml
+++ b/.github/workflows/branches-and-prs.yaml
@@ -22,9 +22,12 @@ jobs:
       name: 'Check out'
       uses: 'actions/checkout@v6'
     - id: 'step-1'
+      name: 'Install pinned Kotlin (work-around for KT-86352)'
+      uses: './.github/actions/install-pinned-kotlin'
+    - id: 'step-2'
       name: 'Execute script'
       run: 'rm ''.github/workflows/branches-and-prs.yaml'' && ''.github/workflows/branches-and-prs.main.kts'''
-    - id: 'step-2'
+    - id: 'step-3'
       name: 'Consistency check'
       run: 'git diff --exit-code ''.github/workflows/branches-and-prs.yaml'''
   check_all_workflow_yaml_consistency:
@@ -37,9 +40,12 @@ jobs:
       name: 'Checkout Repository'
       uses: 'actions/checkout@v6'
     - id: 'step-1'
+      name: 'Install pinned Kotlin (work-around for KT-86352)'
+      uses: './.github/actions/install-pinned-kotlin'
+    - id: 'step-2'
       name: 'Regenerate all Workflow YAMLs'
       run: 'find .github/workflows -mindepth 1 -maxdepth 1 -name ''*.main.kts'' -exec {} \;'
-    - id: 'step-2'
+    - id: 'step-3'
       name: 'Check for Modifications'
       run: |-
         git add --intent-to-add .
diff --git a/.github/workflows/codeql-analysis.main.kts b/.github/workflows/codeql-analysis.main.kts
index c2df7f3b11..3ee53bf992 100755
--- a/.github/workflows/codeql-analysis.main.kts
+++ b/.github/workflows/codeql-analysis.main.kts
@@ -36,8 +36,6 @@ import io.github.typesafegithub.workflows.domain.triggers.*
 import io.github.typesafegithub.workflows.dsl.expressions.Contexts.github
 import io.github.typesafegithub.workflows.dsl.expressions.expr
 import io.github.typesafegithub.workflows.dsl.workflow
-import io.github.typesafegithub.workflows.yaml.CheckoutActionVersionSource.InferFromClasspath
-import io.github.typesafegithub.workflows.yaml.DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG
 
 workflow(
     name = "Code scanning - action",
@@ -63,9 +61,7 @@ workflow(
         group = "${expr { github.workflow }}-${expr("${github.eventPullRequest.pull_request.number} || ${github.ref}")}",
         cancelInProgress = true
     ),
-    consistencyCheckJobConfig = DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG.copy(
-        checkoutActionVersion = InferFromClasspath()
-    )
+    consistencyCheckJobConfig = commonConsistencyCheckJobConfig
 ) {
     job(
         id = "codeql-build",
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 11cf36164c..2374c1f887 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -23,9 +23,12 @@ jobs:
       name: 'Check out'
       uses: 'actions/checkout@v6'
     - id: 'step-1'
+      name: 'Install pinned Kotlin (work-around for KT-86352)'
+      uses: './.github/actions/install-pinned-kotlin'
+    - id: 'step-2'
       name: 'Execute script'
       run: 'rm ''.github/workflows/codeql-analysis.yaml'' && ''.github/workflows/codeql-analysis.main.kts'''
-    - id: 'step-2'
+    - id: 'step-3'
       name: 'Consistency check'
       run: 'git diff --exit-code ''.github/workflows/codeql-analysis.yaml'''
   codeql-build:
diff --git a/.github/workflows/common.main.kts b/.github/workflows/common.main.kts
index 96f5b9f8cb..d8d2ae29be 100755
--- a/.github/workflows/common.main.kts
+++ b/.github/workflows/common.main.kts
@@ -28,6 +28,8 @@ import io.github.typesafegithub.workflows.dsl.JobBuilder
 import io.github.typesafegithub.workflows.dsl.WorkflowBuilder
 import io.github.typesafegithub.workflows.dsl.expressions.Contexts.secrets
 import io.github.typesafegithub.workflows.dsl.expressions.expr
+import io.github.typesafegithub.workflows.yaml.CheckoutActionVersionSource.InferFromClasspath
+import io.github.typesafegithub.workflows.yaml.DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG
 import java.util.Properties
 
 val GRADLE_ENTERPRISE_ACCESS_KEY by secrets
@@ -36,6 +38,26 @@ val commonCredentials = mapOf(
     "DEVELOCITY_ACCESS_KEY" to expr(GRADLE_ENTERPRISE_ACCESS_KEY)
 )
 
+// Work-around for https://youtrack.jetbrains.com/issue/KT-86352,
+// see the action definition for details.
+object InstallPinnedKotlin : LocalAction<Outputs>("./.github/actions/install-pinned-kotlin") {
+    override fun toYamlArguments() = linkedMapOf<String, String>()
+
+    override fun buildOutputObject(stepId: String): Outputs = Outputs(stepId)
+}
+
+fun JobBuilder<*>.installPinnedKotlin() {
+    uses(
+        name = "Install pinned Kotlin (work-around for KT-86352)",
+        action = InstallPinnedKotlin
+    )
+}
+
+val commonConsistencyCheckJobConfig = DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG.copy(
+    checkoutActionVersion = InferFromClasspath(),
+    additionalSteps = { installPinnedKotlin() }
+)
+
 data class Strategy(
     val failFast: Boolean? = false,
     val matrix: Matrix? = null
diff --git a/.github/workflows/docs-pr.main.kts b/.github/workflows/docs-pr.main.kts
index b71f142074..cf6e9b41fa 100755
--- a/.github/workflows/docs-pr.main.kts
+++ b/.github/workflows/docs-pr.main.kts
@@ -37,8 +37,6 @@ import io.github.typesafegithub.workflows.domain.triggers.Push
 import io.github.typesafegithub.workflows.dsl.expressions.Contexts.github
 import io.github.typesafegithub.workflows.dsl.expressions.expr
 import io.github.typesafegithub.workflows.dsl.workflow
-import io.github.typesafegithub.workflows.yaml.CheckoutActionVersionSource.InferFromClasspath
-import io.github.typesafegithub.workflows.yaml.DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG
 
 workflow(
     name = "Verify Docs",
@@ -58,9 +56,7 @@ workflow(
         group = "${expr { github.workflow }}-${expr("${github.eventPullRequest.pull_request.number} || ${github.ref}")}",
         cancelInProgress = true
     ),
-    consistencyCheckJobConfig = DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG.copy(
-        checkoutActionVersion = InferFromClasspath()
-    )
+    consistencyCheckJobConfig = commonConsistencyCheckJobConfig
 ) {
     job(
         id = "docs-and-javadoc",
diff --git a/.github/workflows/docs-pr.yaml b/.github/workflows/docs-pr.yaml
index ee37eb4db5..27477365fd 100644
--- a/.github/workflows/docs-pr.yaml
+++ b/.github/workflows/docs-pr.yaml
@@ -22,9 +22,12 @@ jobs:
       name: 'Check out'
       uses: 'actions/checkout@v6'
     - id: 'step-1'
+      name: 'Install pinned Kotlin (work-around for KT-86352)'
+      uses: './.github/actions/install-pinned-kotlin'
+    - id: 'step-2'
       name: 'Execute script'
       run: 'rm ''.github/workflows/docs-pr.yaml'' && ''.github/workflows/docs-pr.main.kts'''
-    - id: 'step-2'
+    - id: 'step-3'
       name: 'Consistency check'
       run: 'git diff --exit-code ''.github/workflows/docs-pr.yaml'''
   docs-and-javadoc:
diff --git a/.github/workflows/release.main.kts b/.github/workflows/release.main.kts
index d2c4fd9162..2cd767313b 100755
--- a/.github/workflows/release.main.kts
+++ b/.github/workflows/release.main.kts
@@ -35,8 +35,6 @@ import io.github.typesafegithub.workflows.dsl.expressions.Contexts.github
 import io.github.typesafegithub.workflows.dsl.expressions.Contexts.secrets
 import io.github.typesafegithub.workflows.dsl.expressions.expr
 import io.github.typesafegithub.workflows.dsl.workflow
-import io.github.typesafegithub.workflows.yaml.CheckoutActionVersionSource.InferFromClasspath
-import io.github.typesafegithub.workflows.yaml.DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG
 
 workflow(
     name = "Build and Release Spock",
@@ -47,9 +45,7 @@ workflow(
         )
     ),
     sourceFile = __FILE__,
-    consistencyCheckJobConfig = DEFAULT_CONSISTENCY_CHECK_JOB_CONFIG.copy(
-        checkoutActionVersion = InferFromClasspath()
-    )
+    consistencyCheckJobConfig = commonConsistencyCheckJobConfig
 ) {
     val GITHUB_TOKEN by secrets
     val SONATYPE_OSS_USER by secrets
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index fa4ed402b2..29bc8ddfbf 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -18,9 +18,12 @@ jobs:
       name: 'Check out'
       uses: 'actions/checkout@v6'
     - id: 'step-1'
+      name: 'Install pinned Kotlin (work-around for KT-86352)'
+      uses: './.github/actions/install-pinned-kotlin'
+    - id: 'step-2'
       name: 'Execute script'
       run: 'rm ''.github/workflows/release.yaml'' && ''.github/workflows/release.main.kts'''
-    - id: 'step-2'
+    - id: 'step-3'
       name: 'Consistency check'
       run: 'git diff --exit-code ''.github/workflows/release.yaml'''
   build-and-verify: