diff --git a/.github/actions/setup/action.yaml b/.github/actions/setup/action.yaml
index aedb8ea..cd66424 100644
--- a/.github/actions/setup/action.yaml
+++ b/.github/actions/setup/action.yaml
@@ -1,5 +1,11 @@
 name: setup
-description: Setup mise, node, and pnpm.
+description: Setup mise (node, pnpm, actionlint, ...). Optionally install pnpm dependencies.
+
+inputs:
+  install:
+    description: 'Run `pnpm install --frozen-lockfile` and prime the pnpm store cache. Set to "false" for jobs that only need binaries from mise.'
+    required: false
+    default: 'true'
 
 runs:
   using: composite
@@ -8,10 +14,12 @@ runs:
 
     - name: Get pnpm store directory
       id: pnpm-store
-      run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
+      if: inputs.install == 'true'
       shell: bash
+      run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
 
     - name: Cache pnpm store
+      if: inputs.install == 'true'
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ steps.pnpm-store.outputs.path }}
@@ -19,5 +27,6 @@ runs:
         restore-keys: |
           pnpm-store-${{ runner.os }}-
 
-    - run: pnpm i --frozen-lockfile
+    - if: inputs.install == 'true'
       shell: bash
+      run: pnpm i --frozen-lockfile
diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index 9bb64af..0406ea1 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -28,9 +28,9 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      # Not using ./.github/actions/setup: actionlint is a standalone binary
-      # and the composite's pnpm install is unnecessary here.
-      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+      - uses: ./.github/actions/setup
+        with:
+          install: 'false'
 
       - name: Run actionlint
         run: actionlint -color
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 1f5066e..724cebc 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -11,7 +11,29 @@ on:
       - main
       - 'releases/*'
 
+permissions:
+  contents: read
+
 jobs:
+  commitlint:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - uses: ./.github/actions/setup
+
+      - name: Commitlint
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: pnpm exec commitlint --from="$BASE_SHA" --to="$HEAD_SHA" --verbose
+
   build_and_test:
     runs-on: ubuntu-latest
     steps:
diff --git a/.github/workflows/commitlint.yaml b/.github/workflows/commitlint.yaml
deleted file mode 100644
index e6c2575..0000000
--- a/.github/workflows/commitlint.yaml
+++ /dev/null
@@ -1,27 +0,0 @@
-name: Lint Commit Messages
-
-on:
-  pull_request:
-    types:
-      - opened
-      - synchronize
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  commitlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 0
-
-      - uses: ./.github/actions/setup
-
-      - name: Commitlint
-        env:
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: pnpm exec commitlint --from="$BASE_SHA" --to="$HEAD_SHA" --verbose