diff --git a/.github/workflows/safe-settings-sync.yml b/.github/workflows/safe-settings-sync.yml
index b14bcbd..88030e0 100644
--- a/.github/workflows/safe-settings-sync.yml
+++ b/.github/workflows/safe-settings-sync.yml
@@ -20,11 +20,12 @@ on:
 jobs:
   sync:
     name: Sync org settings${{ github.event.inputs.nop == 'true' && ' (dry-run)' || '' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
     permissions:
       contents: read
     env:
-      SAFE_SETTINGS_VERSION: 2.1.17
+      SAFE_SETTINGS_VERSION: 2.1.19
       SAFE_SETTINGS_CODE_DIR: ${{ github.workspace }}/.safe-settings-code
     steps:
       - name: Checkout admin repo (settings source)
@@ -34,7 +35,7 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: github/safe-settings
-          ref: ${{ env.SAFE_SETTINGS_VERSION }}
+          ref: ${{ env.SAFE_SETTINGS_VERSION }} # pin: 6a8b6ae084987025f6c5de85e3cc6df140f64502
           path: ${{ env.SAFE_SETTINGS_CODE_DIR }}
 
       - name: Setup Node.js
@@ -45,7 +46,7 @@ jobs:
           cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json
 
       - name: Install dependencies
-        run: npm install
+        run: npm ci
         working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
 
       - name: Run full sync
diff --git a/CLAUDE.md b/CLAUDE.md
index 95a888f..571f44c 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -90,9 +90,8 @@ These are **already worked around** in this repo — do not undo them:
    up listed twice and the API rejects it. Set bypass **only** in `settings.yml`.
 
 4. **probot v14 full-sync break** — fixed in 2.1.19+ via
-   [PR #949](https://github.com/github/safe-settings/pull/949). The version is currently pinned to
-   `2.1.17` in `.github/workflows/safe-settings-sync.yml` (`SAFE_SETTINGS_VERSION`). Upgrading to
-   `2.1.19` is safe; always do a dry-run first.
+   [PR #949](https://github.com/github/safe-settings/pull/949). The version is now running `2.1.19`
+   in `.github/workflows/safe-settings-sync.yml` (`SAFE_SETTINGS_VERSION`).
 
 ## Open hygiene issues (tracked in this repo's GitHub Issues)