diff --git a/images/actions-runner/metadata.yaml b/images/actions-runner/metadata.yaml
index 2e2b514..52b6c0e 100644
--- a/images/actions-runner/metadata.yaml
+++ b/images/actions-runner/metadata.yaml
@@ -7,7 +7,7 @@ description: GitHub Actions runner for Actions Runner Controller, with docker CL
 # tracks upstream on RUNNER_VERSION in the Dockerfile — deliberately not
 # annotated here, since a -N suffix is a semver pre-release and would be
 # "upgraded" straight back to the bare release.
-version: 2.336.0-3
+version: 2.336.0-4
 platforms:
   - linux/amd64
   - linux/arm64
diff --git a/images/actions-runner/mise.toml b/images/actions-runner/mise.toml
index ef9d340..6d716bf 100644
--- a/images/actions-runner/mise.toml
+++ b/images/actions-runner/mise.toml
@@ -6,6 +6,7 @@
 # pins against (language runtimes, kubectl, helm) stays out and is left to the
 # setup-* actions, which cache into RUNNER_TOOL_CACHE.
 [tools]
+actionlint = "1.7.12"
 gh = "2.96.0"
 hadolint = "2.14.0"
 shellcheck = "0.11.0"