diff --git a/.changeset/fix-pin-dev-deps.md b/.changeset/fix-pin-dev-deps.md
new file mode 100644
index 00000000..1f13a38e
--- /dev/null
+++ b/.changeset/fix-pin-dev-deps.md
@@ -0,0 +1,5 @@
+---
+"@googleworkspace/cli": patch
+---
+
+Pin devDependencies to exact versions to prevent unreviewed minor/patch updates
diff --git a/package.json b/package.json
index 2a556aad..4906e2dd 100644
--- a/package.json
+++ b/package.json
@@ -51,7 +51,7 @@
     "rust"
   ],
   "devDependencies": {
-    "@changesets/cli": "^2.29.8",
-    "lefthook": "^2.1.2"
+    "@changesets/cli": "2.29.8",
+    "lefthook": "2.1.2"
   }
 }