diff --git a/requirements.yml b/requirements.yml
index 7905fab..a323a45 100644
--- a/requirements.yml
+++ b/requirements.yml
@@ -1,11 +1,19 @@
 ---
 # Ansible collections needed by the playbooks.
 # Semaphore installs these before running (Task Template -> "install requirements").
+#
+# Versions are PINNED. Leaving them unpinned makes ansible-galaxy hit the Galaxy
+# version-listing endpoint, which triggers a KeyError:'results' bug in this
+# ansible-core/galaxy combo. Pinning a concrete version avoids that code path.
 collections:
-  - name: community.docker      # docker_compose_v2 module (Homarr deploy)
-  - name: ansible.posix         # authorized_key module (install SSH keys)
-  - name: infisical.vault       # read secrets from Infisical (precheck)
-  - name: community.general     # flatpak + flatpak_remote modules (thinkcenter-flatpak)
+  - name: community.docker
+    version: "3.13.1"        # docker_compose_v2 module (Homarr deploy)
+  - name: ansible.posix
+    version: "1.6.2"         # authorized_key module (install SSH keys)
+  - name: infisical.vault
+    version: "1.2.1"         # read secrets from Infisical (precheck)
+  - name: community.general
+    version: "9.5.0"         # flatpak / flatpak_remote / ufw modules
 
 # NOTE: infisical.vault also needs the Python package `infisicalsdk` on the runner:
 #   pip install infisicalsdk