diff --git a/.github/actions/install-whitaker/CHANGELOG.md b/.github/actions/install-whitaker/CHANGELOG.md
index 22d912005..c91664106 100644
--- a/.github/actions/install-whitaker/CHANGELOG.md
+++ b/.github/actions/install-whitaker/CHANGELOG.md
@@ -5,6 +5,12 @@ file.
 
 ## v1.0.0 (Unreleased)
 
+- Default `installer-version` to 0.2.10 and pin its five release archive
+  digests, computed from an independent download and cross-checked against the
+  release sidecars. 0.2.10 updates the installer's managed checkout with a
+  fetch and hard reset rather than `git pull`, which aborted on stale cached
+  checkouts. 0.2.9 stays pinned and remains the floor.
+
 - Enforce the estate's Whitaker install rule. The installer always receives
   `--no-source-fallback`, whatever `ci-mode` says, so a missing published lint
   library or Dylint tool archive fails before Cargo starts. The default
diff --git a/.github/actions/install-whitaker/README.md b/.github/actions/install-whitaker/README.md
index 37e4ac0e0..e8d216ff7 100644
--- a/.github/actions/install-whitaker/README.md
+++ b/.github/actions/install-whitaker/README.md
@@ -83,7 +83,7 @@ home would otherwise keep serving an installer built for an older version.
 | Name                | Type   | Description                                              | Required | Default        |
 | ------------------- | ------ | -------------------------------------------------------- | -------- | -------------- |
 | `cargo-home`        | string | Cargo home holding the cached installer binary           | no       | `~/.cargo`     |
-| `installer-version` | string | Version of `whitaker-installer`, 0.2.9 or later          | no       | `0.2.9`        |
+| `installer-version` | string | Version of `whitaker-installer`, 0.2.9 or later          | no       | `0.2.10`       |
 | `installer-sha256`  | string | Digest for an asset the manifest does not pin            | no       | `""`           |
 | `suite-version`     | string | Refused: any non-empty value fails the step              | no       | `""`           |
 | `cache-provider`    | string | Built-in `github` or caller-owned `external`             | no       | `github`       |
diff --git a/.github/actions/install-whitaker/action.yml b/.github/actions/install-whitaker/action.yml
index b4c31b844..d3c5a6cdf 100644
--- a/.github/actions/install-whitaker/action.yml
+++ b/.github/actions/install-whitaker/action.yml
@@ -12,7 +12,7 @@ inputs:
       action pins, and must be 0.2.9 or later: that is the first release with
       --no-source-fallback, which the action always passes.
     required: false
-    default: "0.2.9"
+    default: "0.2.10"
   installer-sha256:
     description: >-
       SHA-256 digest of the whitaker-installer release archive for this
diff --git a/.github/actions/install-whitaker/installer-digests.sha256 b/.github/actions/install-whitaker/installer-digests.sha256
index be01a067f..7cf914ae8 100644
--- a/.github/actions/install-whitaker/installer-digests.sha256
+++ b/.github/actions/install-whitaker/installer-digests.sha256
@@ -9,3 +9,8 @@
 d7afbed4170a5a54a12f2298cce41cf00330d5629d645a46dde716123be722f9  whitaker-installer-x86_64-apple-darwin-v0.2.9.tgz
 e84e5d9119b14ed6ddbe6067bd4bcce1c3e90be403096612d3cf9b37a0bf6451  whitaker-installer-x86_64-pc-windows-msvc-v0.2.9.zip
 71ba9b6de2b9550c70a5bf1be606e2cb6afc9515f56c3fc7b5f5d6ca1fe39b0e  whitaker-installer-x86_64-unknown-linux-gnu-v0.2.9.tgz
+554b4720a3735e3f58220ae8479a482ad31083d58a17ad3c450da9b799ec704c  whitaker-installer-aarch64-apple-darwin-v0.2.10.tgz
+384b9800e54bc32a9f328954acce858f2c2057de75d4dcf99e1e6bb97398f4f5  whitaker-installer-aarch64-unknown-linux-gnu-v0.2.10.tgz
+941fb3cfbe58a2ef95578bb6bab86498fb0b1719ef3e8542606cee1d726fd9cc  whitaker-installer-x86_64-apple-darwin-v0.2.10.tgz
+20ea775948f599c16b264016e56cfa0369cfdb3156a699193481e39023cb4605  whitaker-installer-x86_64-unknown-linux-gnu-v0.2.10.tgz
+03ee2754d7f697a36339e956cc5ca8aedeb9ec2a1bb4e64e556d0dadf5a7ae9a  whitaker-installer-x86_64-pc-windows-msvc-v0.2.10.zip
diff --git a/.github/actions/install-whitaker/tests/test_install_whitaker.py b/.github/actions/install-whitaker/tests/test_install_whitaker.py
index f2066c414..442ef58f5 100644
--- a/.github/actions/install-whitaker/tests/test_install_whitaker.py
+++ b/.github/actions/install-whitaker/tests/test_install_whitaker.py
@@ -31,7 +31,7 @@
     "x86_64-pc-windows-msvc",
     "x86_64-unknown-linux-gnu",
 )
-_PINNED_VERSIONS = ("0.2.9",)
+_PINNED_VERSIONS = ("0.2.9", "0.2.10")
 
 
 def _step_env(name: str) -> dict[str, str]:
@@ -70,7 +70,7 @@ def _step_script(name: str) -> str:
             "always passes."
         ),
         "required": False,
-        "default": "0.2.9",
+        "default": "0.2.10",
     },
     "installer-sha256": {
         "description": (
diff --git a/.github/workflows/test-install-whitaker.yml b/.github/workflows/test-install-whitaker.yml
index 6f957dda7..f92ae984e 100644
--- a/.github/workflows/test-install-whitaker.yml
+++ b/.github/workflows/test-install-whitaker.yml
@@ -12,7 +12,7 @@ permissions:
   contents: read
 
 env:
-  WHITAKER_TEST_INSTALLER_VERSION: 0.2.9
+  WHITAKER_TEST_INSTALLER_VERSION: 0.2.10
 
 jobs:
   install-whitaker: