diff --git a/.github/workflows/build-validation.yml b/.github/workflows/build-validation.yml
index 2c42e863..a9fae686 100644
--- a/.github/workflows/build-validation.yml
+++ b/.github/workflows/build-validation.yml
@@ -64,15 +64,21 @@ jobs:
 
   # panel-clades grades ABI: PanelClades.ABI.Grades typechecks against
   # typed-wasm's grade kernel at its pin, and the expected rejections are
-  # refused.  Idris2 publishes no binaries, so 0.8.0 is built from its tag.
+  # refused.  Idris2 publishes no binaries, so 0.8.0 is built from source,
+  # fetched by the commit its v0.8.0 tag names (a tag can move; the SHA
+  # cannot).
   panel-clades-abi:
     runs-on: ubuntu-latest
     timeout-minutes: 40
     permissions:
       contents: read
+    env:
+      IDRIS2_COMMIT: 15a3e4e70843f7a34100f6470c04b791330788df  # v0.8.0
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Chez Scheme and GMP
         run: |
@@ -81,7 +87,13 @@ jobs:
 
       - name: Build Idris2 0.8.0 from source
         run: |
-          git clone --quiet --depth 1 --branch v0.8.0 https://github.com/idris-lang/Idris2 "$RUNNER_TEMP/idris2-src"
+          git init --quiet "$RUNNER_TEMP/idris2-src"
+          git -C "$RUNNER_TEMP/idris2-src" fetch --quiet --depth 1 https://github.com/idris-lang/Idris2 "$IDRIS2_COMMIT"
+          git -C "$RUNNER_TEMP/idris2-src" checkout --quiet --detach FETCH_HEAD
+          test "$(git -C "$RUNNER_TEMP/idris2-src" rev-parse HEAD)" = "$IDRIS2_COMMIT"
+          # Local tag on the verified commit, so the Makefile reports the
+          # release version (0.8.0) rather than 0.8.0-<sha>.
+          git -C "$RUNNER_TEMP/idris2-src" tag v0.8.0
           make -C "$RUNNER_TEMP/idris2-src" bootstrap SCHEME=scheme -j"$(nproc)" > "$RUNNER_TEMP/idris2-build.log" 2>&1 \
             || { tail -60 "$RUNNER_TEMP/idris2-build.log"; exit 1; }
           make -C "$RUNNER_TEMP/idris2-src" install > "$RUNNER_TEMP/idris2-install.log" 2>&1 \
diff --git a/panel-clades/scripts/check-abi.sh b/panel-clades/scripts/check-abi.sh
index 3760cee6..7400dd18 100755
--- a/panel-clades/scripts/check-abi.sh
+++ b/panel-clades/scripts/check-abi.sh
@@ -35,7 +35,8 @@ TW="_build/dependencies/typed-wasm/src/abi"
 rm -rf "$TW/build"
 if ! (cd "$TW" && idris2 --build typed-wasm.ipkg) > "$OUT/kernel.log" 2>&1 \
    || grep -q '^Error' "$OUT/kernel.log"; then
-  grep -A10 '^Error' "$OUT/kernel.log" | head -30; die "typed-wasm's ABI package does not build at the pin"
+  { grep -A10 '^Error' "$OUT/kernel.log" || tail -30 "$OUT/kernel.log"; } | head -30
+  die "typed-wasm's ABI package does not build at the pin"
 fi
 pass "typed-wasm grade kernel built at $(git -C _build/dependencies/typed-wasm rev-parse --short HEAD)"
 KTTC="$ROOT/$TW/build/ttc"
@@ -46,7 +47,8 @@ st=$?
 if [ "$st" -eq 0 ] && ! grep -q '^Error' "$OUT/grades.log"; then
   pass "panel-clades-grades.ipkg builds against the kernel ($(grep -c ': Building ' "$OUT/grades.log") module(s), 0 errors)"
 else
-  grep -A12 '^Error' "$OUT/grades.log" | head -40; err "panel-clades-grades.ipkg (exit $st)"
+  { grep -A12 '^Error' "$OUT/grades.log" || tail -40 "$OUT/grades.log"; } | head -40
+  err "panel-clades-grades.ipkg (exit $st)"
 fi
 PTTC="$ROOT/src/abi/build/ttc"