diff --git a/mise.toml b/mise.toml
index 36a75d8..5c2bd82 100644
--- a/mise.toml
+++ b/mise.toml
@@ -9,7 +9,7 @@ node = "24.19.0"
 # Must match package.json's `packageManager` field so the lockfile metadata
 # version is not migrated by a newer yarn. Renovate updates package.json but
 # not this pin, so the two have to be changed in lockstep.
-yarn = "4.17.1"
+yarn = "4.18.0"
 # Used by scripts/auto-bump-packages.sh to build its JSON summary. Preinstalled
 # on GitHub's ubuntu runners, pinned here so local runs match.
 jq = "1.8.2"
diff --git a/package.json b/package.json
index 5efe4f1..d64ad0b 100644
--- a/package.json
+++ b/package.json
@@ -20,7 +20,7 @@
   "resolutions": {
     "yoctocolors": "2.2.0"
   },
-  "packageManager": "yarn@4.17.1+sha512.ccbfabf7d7b6b32075088be9386fb9a2e00bb6887ef07fa56effabc890a56d53da1ccc4128d62db245fcbd3961b236d75335bdf7d5320ed6eafb7588b7ad4697",
+  "packageManager": "yarn@4.18.0+sha512.fcb8716fe7cd0eece141ffc18b92193a9df9204c1ba83189c288835223fc0bbe64af473bab0d5e9927a7daeb5caf2bb07eb2787cc9338ca040ea125f2a1f2f7e",
   "engines": {
     "node": ">=24.18.1"
   }