diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 3fc0fbb..9ed23fb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -17,22 +17,22 @@ env:
   V3_COMMIT: f59b886d2564e37d8626d715236fdfa928e13dda
   V3_VC_COMMIT: 4598bc7e4894c154b27391e4442005fff2fbbd68
   V3_TCC_COMMIT: d6e7ac1b1bcc98aed734a6ecbfa8509f24606c74
-  VULKAN_COMMIT: ef299424a8411ee7269080545da2d15c8b25059d
+  VULKAN_REF: v2.0.0
   GLFW_COMMIT: 3d7c1ddacb7215a7bbeb5fef0d7a68c90ba392ed
 
 jobs:
   test:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Check out pinned Vulkan module
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: antono2/vulkan
-          ref: ${{ env.VULKAN_COMMIT }}
+          ref: ${{ env.VULKAN_REF }}
           path: .ci-modules/vulkan
       - name: Check out pinned GLFW module
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: antono2/glfw
           ref: ${{ env.GLFW_COMMIT }}
@@ -41,7 +41,7 @@ jobs:
         run: |
           generator_commit=$(cat GENERATOR_COMMIT)
           [[ "$generator_commit" =~ ^[0-9a-f]{40}$ ]]
-      - uses: prantlf/setup-v-action@v4
+      - uses: prantlf/setup-v-action@92f20bea50d2c9931a28c96bb4997a3c7357baf0 # v4
         with:
           version: ${{ env.V_VERSION }}
       - name: Install native dependencies
@@ -56,7 +56,7 @@ jobs:
           install -m 0644 opencl.v convenience.v ownership.v program.v event.v image.v svm.v capabilities.v external_interop.v v.mod VERSION LICENSE GENERATOR_COMMIT "$HOME/.vmodules/antono2/opencl/"
           install -d "$HOME/.vmodules/antono2/opencl/include/CL"
           install -m 0644 include/CL/opencl.h "$HOME/.vmodules/antono2/opencl/include/CL/opencl.h"
-          test "$(git -C .ci-modules/vulkan rev-parse HEAD)" = "$VULKAN_COMMIT"
+          test "$(git -C .ci-modules/vulkan describe --tags --exact-match)" = "$VULKAN_REF"
           test "$(git -C .ci-modules/glfw rev-parse HEAD)" = "$GLFW_COMMIT"
           install -d "$HOME/.vmodules/antono2/vulkan" "$HOME/.vmodules/antono2/glfw"
           cp -a .ci-modules/vulkan/. "$HOME/.vmodules/antono2/vulkan/"
@@ -92,8 +92,8 @@ jobs:
   macos-abi-compile:
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v7
-      - uses: prantlf/setup-v-action@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: prantlf/setup-v-action@92f20bea50d2c9931a28c96bb4997a3c7357baf0 # v4
         with:
           version: ${{ env.V_VERSION }}
       - name: Assemble namespaced module
@@ -110,12 +110,12 @@ jobs:
   linux-v-master:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       # V master currently builds a separate v1_fallback executable for tool
       # commands such as `v test`. Keep the complete source build together;
       # setup-v-action@v4's reduced cache bundle omits that executable.
       - name: Check out V master
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         id: checkout_v_master
         continue-on-error: true
         with:
@@ -156,23 +156,23 @@ jobs:
     name: Strict V3 frontend
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Check out pinned V3 compiler
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: vlang/v
           ref: ${{ env.V3_COMMIT }}
           path: .ci-v3
           fetch-depth: 1
       - name: Check out matching V3 bootstrap source
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: vlang/vc
           ref: ${{ env.V3_VC_COMMIT }}
           path: .ci-v3/vc
           fetch-depth: 1
       - name: Check out matching V3 TinyCC runtime
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: vlang/tccbin
           ref: ${{ env.V3_TCC_COMMIT }}
@@ -207,8 +207,8 @@ jobs:
   windows-abi-compile:
     runs-on: windows-2022
     steps:
-      - uses: actions/checkout@v7
-      - uses: prantlf/setup-v-action@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: prantlf/setup-v-action@92f20bea50d2c9931a28c96bb4997a3c7357baf0 # v4
         with:
           version: ${{ env.V_VERSION }}
       - name: Install OpenCL SDK
@@ -229,6 +229,41 @@ jobs:
           v run setup.vsh --check
           v -cc msvc -o "$env:TEMP/opencl-abi-probe.exe" abi/main.c.v
 
+  linux-dependency-master:
+    name: Advisory Vulkan and GLFW master
+    continue-on-error: true
+    runs-on: ubuntu-24.04
+    env:
+      VULKAN_SDK: /usr
+      GLFW_INCLUDE: /usr/include
+      GLFW_LIB: /usr/lib/x86_64-linux-gnu
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: antono2/vulkan
+          ref: master
+          path: .ci-modules/vulkan
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          repository: antono2/glfw
+          ref: master
+          path: .ci-modules/glfw
+      - uses: prantlf/setup-v-action@92f20bea50d2c9931a28c96bb4997a3c7357baf0 # v4
+        with:
+          version: ${{ env.V_VERSION }}
+      - name: Install native dependencies
+        run: sudo apt-get update && sudo apt-get install -y ocl-icd-opencl-dev pocl-opencl-icd libvulkan-dev libvulkan-volk-dev libglfw3-dev
+      - name: Assemble modules and compile particles
+        run: |
+          mkdir -p "$HOME/.vmodules/antono2/opencl" "$HOME/.vmodules/antono2/vulkan" "$HOME/.vmodules/antono2/glfw"
+          cp -a .ci-modules/vulkan/. "$HOME/.vmodules/antono2/vulkan/"
+          cp -a .ci-modules/glfw/. "$HOME/.vmodules/antono2/glfw/"
+          cp opencl.v convenience.v ownership.v program.v event.v image.v svm.v capabilities.v external_interop.v v.mod "$HOME/.vmodules/antono2/opencl/"
+          mkdir -p "$HOME/.vmodules/antono2/opencl/include/CL"
+          cp include/CL/opencl.h "$HOME/.vmodules/antono2/opencl/include/CL/"
+          v -cc gcc -o "$RUNNER_TEMP/vulkan-particles" examples/vulkan_particles
+
   required-checks:
     name: required-checks
     if: always()
@@ -254,7 +289,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
       - name: Validate release version and generator provenance
diff --git a/README.md b/README.md
index 78d2f8b..65862aa 100644
--- a/README.md
+++ b/README.md
@@ -47,7 +47,7 @@ determined by the installed OpenCL implementation at runtime.
 Install the module from VPM:
 
 ```sh
-v install antono2.opencl
+v install antono2.opencl@v1.0.0
 ```
 
 ```v
diff --git a/examples/vulkan_particles/README.md b/examples/vulkan_particles/README.md
index a905176..e590645 100644
--- a/examples/vulkan_particles/README.md
+++ b/examples/vulkan_particles/README.md
@@ -28,8 +28,8 @@ checked-in SPIR-V after editing GLSL with `./compile_shaders.sh`.
 Install the example-only V modules and Linux development packages before building from source:
 
 ```sh
-v install antono2.opencl
-v install antono2.vulkan
+v install antono2.opencl@v1.0.0
+v install antono2.vulkan@v2.0.0
 v install antono2.glfw
 sudo apt install ocl-icd-opencl-dev libvulkan-dev libglfw3-dev
 ```
@@ -52,7 +52,7 @@ v -cc gcc run examples/vulkan_particles --particles=4096
 v -cc tcc run examples/vulkan_particles --particles=4096
 ```
 
-TinyCC requires `antono2.vulkan` 1.7.0 or newer for its deep-bound Volk loader.
+TinyCC requires `antono2.vulkan` v2.0.0 for its deep-bound Volk loader.
 
 ## Tested hardware
 
diff --git a/examples/vulkan_particles/v.mod b/examples/vulkan_particles/v.mod
index 031af3e..81e337e 100644
--- a/examples/vulkan_particles/v.mod
+++ b/examples/vulkan_particles/v.mod
@@ -3,5 +3,5 @@ Module {
 	description: 'OpenCL particle simulation with a Vulkan renderer'
 	version: '0.1.0'
 	license: 'MIT'
-	dependencies: ['antono2.opencl', 'antono2.vulkan', 'antono2.glfw']
+	dependencies: ['antono2.opencl@v1.0.0', 'antono2.vulkan@v2.0.0', 'antono2.glfw']
 }