diff --git a/.github/workflows/ghpages.yml b/.github/workflows/ghpages.yml
index 9b95e5e..3b1dce7 100644
--- a/.github/workflows/ghpages.yml
+++ b/.github/workflows/ghpages.yml
@@ -46,7 +46,7 @@ jobs:
         run: pip install xml2rfc
 
       - name: "Cache xml2rfc References"
-        uses: actions/cache@6682284cc58b73e9e0655991c2e8e82e47791b2a # v5.0.4
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: .refcache
           key: refcache-${{ hashFiles('draft-*.md') }}
diff --git a/Makefile b/Makefile
index 44e24df..c00af02 100644
--- a/Makefile
+++ b/Makefile
@@ -2,8 +2,14 @@ SHELL := /bin/bash
 .PHONY: all html txt clean
 .DELETE_ON_ERROR:
 
-# Tool configuration
-KRAMDOWN_RFC ?= kramdown-rfc
+# Tool configuration.
+# kramdown-rfc is a Ruby gem managed by Bundler, so we invoke it via
+# `bundle exec` to find the gem on the Bundler load path. This lets plain
+# `make` work both locally and in CI (where ruby/setup-ruby installs gems
+# under a Bundler-managed location that is not on PATH for sub-shells).
+# Override via e.g. `KRAMDOWN_RFC=kramdown-rfc make` if invoking globally
+# installed binaries directly.
+KRAMDOWN_RFC ?= bundle exec kramdown-rfc
 XML2RFC      ?= xml2rfc
 
 # Discover drafts