diff --git a/.envrc b/.envrc
index d30a402..39e841d 100644
--- a/.envrc
+++ b/.envrc
@@ -1,16 +1,12 @@
 #!/bin/bash
 # shellcheck disable=SC1091
 if [[ -f .env ]]; then
-    dotenv .env
+  dotenv .env
 fi
 
-if [ ! -d .venv ]; then
-    echo "warning: creating virtualenv for the first time"
-    python3 -m venv .venv
-    source .venv/bin/activate
-    pip install -r requirements.txt
-    pip install -r requirements-dev.txt
-else
-    source .venv/bin/activate
-    unset PS1
+export REPO=$PWD
+export VIRTUAL_ENV=$REPO/.venv
+path_add PATH $VIRTUAL_ENV/bin
+if [ ! -x "$VIRTUAL_ENV/bin/devservices" ]; then
+  printf >&2 '\033[33mNOTE: please run `make`\033[m'
 fi
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 420cabe..7c14454 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
         run: python -m build
 
       - name: Cache dist
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: dist
           key: devservices-dist-${{ github.sha }}
@@ -70,12 +70,11 @@ jobs:
           cp $BINARY_PATH binaries/${{ matrix.asset_name }}
 
       - name: Cache binary
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: binaries/${{ matrix.asset_name }}
           key: ${{ matrix.asset_name }}-${{ github.sha }}
 
-
   upload-artifacts:
     name: Upload build artifacts
     runs-on: ubuntu-22.04
@@ -83,19 +82,19 @@ jobs:
     if: github.event_name != 'pull_request'
     steps:
       - name: Restore dist cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: dist
           key: devservices-dist-${{ github.sha }}
 
       - name: Restore Linux binary cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: binaries/devservices-linux
           key: devservices-linux-${{ github.sha }}
 
       - name: Restore macOS binary cache
-        uses: actions/cache@ab5e6d0c87105b4c9c2047343972218f562e4319 # v4.0.1
+        uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
         with:
           path: binaries/devservices-darwin
           key: devservices-darwin-${{ github.sha }}
diff --git a/lib/make/venv b/lib/make/venv
new file mode 100755
index 0000000..814ffb4
--- /dev/null
+++ b/lib/make/venv
@@ -0,0 +1,7 @@
+#!/bin/bash
+set -euxo pipefail
+rm -rf venv .venv.tmp
+python3 -m venv .venv.tmp
+./.venv.tmp/bin/pip install -e '.[dev]' -c requirements.txt -c requirements-dev.txt
+mv .venv.tmp .venv
+python3 -m venv .venv  # handle relocation
diff --git a/requirements.txt b/requirements.txt
index 7f1ae87..889d7d5 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,5 +1,5 @@
 --index-url https://pypi.devinfra.sentry.io/simple
-pyyaml==6.0.1
+pyyaml==6.0.2
 packaging==24.0
 sentry-devenv==1.8.0
 sentry-sdk==2.20.0