diff --git a/.github/workflows/evict_caches.yml b/.github/workflows/evict_caches.yaml
similarity index 98%
rename from .github/workflows/evict_caches.yml
rename to .github/workflows/evict_caches.yaml
index a4feeb463e1..b870dd742ab 100644
--- a/.github/workflows/evict_caches.yml
+++ b/.github/workflows/evict_caches.yaml
@@ -89,7 +89,7 @@ jobs:
           		echo Latest commit: $sha
 
           		echo "Trigger workflow on cue-lang/cue"
-          		curl -s -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.CUECKOO_GITHUB_PAT }}" -H "X-GitHub-Api-Version: 2022-11-28" --fail-with-body -X POST https://api.github.com/repos/cue-lang/cue/actions/workflows/trybot.yml/dispatches -d "{\"ref\":\"$j\"}"
+          		curl -s -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.CUECKOO_GITHUB_PAT }}" -H "X-GitHub-Api-Version: 2022-11-28" --fail-with-body -X POST https://api.github.com/repos/cue-lang/cue/actions/workflows/trybot.yaml/dispatches -d "{\"ref\":\"$j\"}"
 
           		# Ensure that the trybot repo has the latest commit for
           		# this branch.  If the force-push results in a commit
@@ -121,7 +121,7 @@ jobs:
           			# We are up-to-date, i.e. the push did nothing, hence we need to trigger a workflow_dispatch
           			# in the trybot repo.
           			echo "Trigger workflow on cue-lang/cue-trybot"
-          			curl -s -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.CUECKOO_GITHUB_PAT }}" -H "X-GitHub-Api-Version: 2022-11-28" --fail-with-body -X POST https://api.github.com/repos/cue-lang/cue-trybot/actions/workflows/trybot.yml/dispatches -d "{\"ref\":\"$j\"}"
+          			curl -s -L -H "Accept: application/vnd.github+json" -H "Authorization: Bearer ${{ secrets.CUECKOO_GITHUB_PAT }}" -H "X-GitHub-Api-Version: 2022-11-28" --fail-with-body -X POST https://api.github.com/repos/cue-lang/cue-trybot/actions/workflows/trybot.yaml/dispatches -d "{\"ref\":\"$j\"}"
           		else
           			echo "Force-push to cue-lang/cue-trybot did work; nothing to do"
           		fi
diff --git a/.github/workflows/push_tip_to_trybot.yml b/.github/workflows/push_tip_to_trybot.yaml
similarity index 100%
rename from .github/workflows/push_tip_to_trybot.yml
rename to .github/workflows/push_tip_to_trybot.yaml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yaml
similarity index 100%
rename from .github/workflows/release.yml
rename to .github/workflows/release.yaml
diff --git a/.github/workflows/tip_triggers.yml b/.github/workflows/tip_triggers.yaml
similarity index 100%
rename from .github/workflows/tip_triggers.yml
rename to .github/workflows/tip_triggers.yaml
diff --git a/.github/workflows/trybot.yml b/.github/workflows/trybot.yaml
similarity index 100%
rename from .github/workflows/trybot.yml
rename to .github/workflows/trybot.yaml
diff --git a/.github/workflows/trybot_dispatch.yml b/.github/workflows/trybot_dispatch.yaml
similarity index 100%
rename from .github/workflows/trybot_dispatch.yml
rename to .github/workflows/trybot_dispatch.yaml
diff --git a/internal/ci/base/base.cue b/internal/ci/base/base.cue
index c0dea7dd934..5304b85f16d 100644
--- a/internal/ci/base/base.cue
+++ b/internal/ci/base/base.cue
@@ -55,7 +55,7 @@ botGerritHubUser:                   *botGitHubUser | string
 botGerritHubUserPasswordSecretsKey: *(strings.ToUpper(botGitHubUser) + "_GERRITHUB_PASSWORD") | string
 botGerritHubUserEmail:              *botGitHubUserEmail | string
 
-workflowFileExtension: ".yml"
+workflowFileExtension: ".yaml"
 
 linuxMachine: string
 
diff --git a/internal/ci/base/github.cue b/internal/ci/base/github.cue
index 2b078e75388..6f49044bd0e 100644
--- a/internal/ci/base/github.cue
+++ b/internal/ci/base/github.cue
@@ -137,7 +137,7 @@ checkoutCode: {
 
 earlyChecks: json.#step & {
 	name: "Early git and code sanity checks"
-	run:  "go run ./internal/ci/checks"
+	run:  *"go run cuelang.org/go/internal/ci/checks@v0.11.0-0.dev.0.20240903133435-46fb300df650" | string
 }
 
 curlGitHubAPI: {
diff --git a/internal/ci/repo/repo.cue b/internal/ci/repo/repo.cue
index 1cf7ca7cb75..479efb2ab0b 100644
--- a/internal/ci/repo/repo.cue
+++ b/internal/ci/repo/repo.cue
@@ -9,6 +9,8 @@ import (
 
 base
 
+earlyChecks: run: "go run ./internal/ci/checks"
+
 githubRepositoryPath: "cue-lang/cue"
 
 unityRepositoryPath: "cue-unity/unity-private"