diff --git a/scripts/install_deps.sh b/scripts/install_deps.sh
index c56dfd4..637e04e 100755
--- a/scripts/install_deps.sh
+++ b/scripts/install_deps.sh
@@ -121,11 +121,21 @@ install_zstd() {
 # Install XGBoost from source
 install_xgboost() {
 	log_info "Installing XGBoost from source..."
+	# Pinned, not tracking master: XGBoost removed the deprecated XGBoosterPredict
+	# after v3.3.0, and libCacheSim's GLCache/inference.c still calls it, so a clone
+	# of master fails to compile with "implicit declaration of function". v3.3.0 is
+	# also what Homebrew installs, so the Linux and macOS wheels build against the
+	# same API. The directory carries the version so a checkout left in /tmp by an
+	# older run of this script is not silently reused.
+	local xgboost_version="v3.3.0"
+	local xgboost_dir="xgboost-${xgboost_version}"
+
 	pushd /tmp/ >/dev/null
-	if [[ ! -d "xgboost" ]]; then
-		git clone --recursive https://github.com/dmlc/xgboost
+	if [[ ! -d "${xgboost_dir}" ]]; then
+		git clone --recursive --depth 1 --branch "${xgboost_version}" \
+			https://github.com/dmlc/xgboost "${xgboost_dir}"
 	fi
-	pushd xgboost >/dev/null
+	pushd "${xgboost_dir}" >/dev/null
 	mkdir -p build
 	pushd build >/dev/null
 	cmake -G Ninja ..
@@ -139,11 +149,18 @@ install_xgboost() {
 # Install LightGBM from source
 install_lightgbm() {
 	log_info "Installing LightGBM from source..."
+	# Pinned for the same reason as XGBoost above -- an unpinned clone means the
+	# build depends on whatever master happens to be that day. v4.7.0 matches the
+	# version Homebrew installs for the macOS wheels.
+	local lightgbm_version="v4.7.0"
+	local lightgbm_dir="LightGBM-${lightgbm_version}"
+
 	pushd /tmp/ >/dev/null
-	if [[ ! -d "LightGBM" ]]; then
-		git clone --recursive https://github.com/microsoft/LightGBM
+	if [[ ! -d "${lightgbm_dir}" ]]; then
+		git clone --recursive --depth 1 --branch "${lightgbm_version}" \
+			https://github.com/microsoft/LightGBM "${lightgbm_dir}"
 	fi
-	pushd LightGBM >/dev/null
+	pushd "${lightgbm_dir}" >/dev/null
 	mkdir -p build
 	pushd build >/dev/null
 	cmake -G Ninja ..
diff --git a/scripts/install_deps_user.sh b/scripts/install_deps_user.sh
index 91a7c0e..d66df77 100644
--- a/scripts/install_deps_user.sh
+++ b/scripts/install_deps_user.sh
@@ -236,14 +236,22 @@ EOF
 install_xgboost() {
     log_step "Installing XGBoost..."
     
+    # Pinned rather than tracking master: XGBoost removed the deprecated
+    # XGBoosterPredict after v3.3.0, which libCacheSim's GLCache/inference.c still
+    # calls, so master no longer compiles. See install_deps.sh for the full note.
+    local xgboost_version="v3.3.0"
+
     pushd "${HOME}/src" >/dev/null
-    
+
     if [[ ! -d "xgboost" ]]; then
         git clone --recursive https://github.com/dmlc/xgboost.git
     fi
-    
+
     pushd xgboost >/dev/null
-    git pull origin master
+    # Fetch and check out the tag instead of pulling master -- this also repoints a
+    # checkout that an older version of this script left on master.
+    git fetch --tags origin
+    git checkout --quiet "${xgboost_version}"
     git submodule update --init --recursive
     
     mkdir -p build
@@ -262,14 +270,18 @@ install_xgboost() {
 install_lightgbm() {
     log_step "Installing LightGBM..."
     
+    # Pinned for the same reason as XGBoost above; v4.7.0 matches Homebrew's version.
+    local lightgbm_version="v4.7.0"
+
     pushd "${HOME}/src" >/dev/null
-    
+
     if [[ ! -d "LightGBM" ]]; then
         git clone --recursive https://github.com/microsoft/LightGBM.git
     fi
-    
+
     pushd LightGBM >/dev/null
-    git pull origin master
+    git fetch --tags origin
+    git checkout --quiet "${lightgbm_version}"
     git submodule update --init --recursive
     
     mkdir -p build