diff --git a/.github/sycl-build-deps.env b/.github/sycl-build-deps.env
new file mode 100644
index 00000000000..6c3ab6eec2e
--- /dev/null
+++ b/.github/sycl-build-deps.env
@@ -0,0 +1,8 @@
+# Pinned open source SYCL build deps, loaded by os-llvm-sycl-build.yml and
+# bumped by bump-sycl-deps.yml. Kept out of .github/workflows/ since
+# GITHUB_TOKEN can't push workflow files. Format: one KEY=VALUE per line.
+DRIVER_PATH=2026-WW28
+OCLCPUEXP_FN=oclcpuexp-2026.22.6.1.17_160000_rel.tar.gz
+TBB_URL=https://github.com/uxlfoundation/oneTBB/releases/download/v2023.1.0/
+TBB_INSTALL_DIR=oneapi-tbb-2023.1.0
+TBB_FN=oneapi-tbb-2023.1.0-lin.tgz
diff --git a/.github/workflows/bump-sycl-deps.yml b/.github/workflows/bump-sycl-deps.yml
index 713b5da2b0e..ff6a868013a 100644
--- a/.github/workflows/bump-sycl-deps.yml
+++ b/.github/workflows/bump-sycl-deps.yml
@@ -2,7 +2,8 @@ name: Bump open source SYCL build deps
 
 # Keeps the pinned oclcpuexp driver (intel/llvm YYYY-WWNN release) and oneTBB
 # release used by os-llvm-sycl-build.yml up to date by opening a pull request
-# when a newer upstream release is available.
+# when a newer upstream release is available. The pins live in
+# .github/sycl-build-deps.env, since GITHUB_TOKEN can't push workflow files.
 
 on:
   # Check weekly on Saturday, and allow manual runs.
@@ -31,7 +32,7 @@ jobs:
       pull-requests: write
 
     env:
-      WF: .github/workflows/os-llvm-sycl-build.yml
+      PINS: .github/sycl-build-deps.env
       GH_TOKEN: ${{ github.token }}
 
     steps:
@@ -91,7 +92,7 @@ jobs:
             echo "tbb_dir=oneapi-tbb-${TBB_VER}"
           } >> "${GITHUB_OUTPUT}"
 
-      - name: Apply pins to workflow file
+      - name: Apply pins to pins file
         env:
           DRIVER_TAG: ${{ steps.resolve.outputs.driver_tag }}
           OCLCPUEXP_FN: ${{ steps.resolve.outputs.oclcpuexp_fn }}
@@ -101,34 +102,34 @@ jobs:
         run: |
           set -euo pipefail
           # Surgical, comment-preserving edits: rewrite only the value after each
-          # key and keep indentation. "|" delimiter so the "/"-heavy URL is safe.
+          # key. "|" delimiter so the "/"-heavy URL is safe.
           sed -i -E \
-            -e "s|^( *DRIVER_PATH: ).*|\1${DRIVER_TAG}|" \
-            -e "s|^( *OCLCPUEXP_FN: ).*|\1${OCLCPUEXP_FN}|" \
-            -e "s|^( *TBB_URL: ).*|\1https://github.com/uxlfoundation/oneTBB/releases/download/${TBB_TAG}/|" \
-            -e "s|^( *TBB_INSTALL_DIR: ).*|\1${TBB_DIR}|" \
-            -e "s|^( *TBB_FN: ).*|\1${TBB_FN}|" \
-            "${WF}"
+            -e "s|^(DRIVER_PATH=).*|\1${DRIVER_TAG}|" \
+            -e "s|^(OCLCPUEXP_FN=).*|\1${OCLCPUEXP_FN}|" \
+            -e "s|^(TBB_URL=).*|\1https://github.com/uxlfoundation/oneTBB/releases/download/${TBB_TAG}/|" \
+            -e "s|^(TBB_INSTALL_DIR=).*|\1${TBB_DIR}|" \
+            -e "s|^(TBB_FN=).*|\1${TBB_FN}|" \
+            "${PINS}"
           echo "---- resulting diff ----"
-          git diff -- "${WF}" || true
+          git diff -- "${PINS}" || true
 
       - name: Create pull request
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ github.token }}
-          add-paths: ${{ env.WF }}
+          add-paths: ${{ env.PINS }}
           branch: bot/bump-sycl-build-deps
           delete-branch: true
           labels: autoupdate
           commit-message: |
-            Bump oclcpuexp/oneTBB pins in os-llvm-sycl-build workflow
+            Bump oclcpuexp/oneTBB pins for os-llvm-sycl-build workflow
 
             driver: ${{ steps.resolve.outputs.driver_tag }} / ${{ steps.resolve.outputs.oclcpuexp_fn }}
             oneTBB: ${{ steps.resolve.outputs.tbb_tag }}
           title: "Bump open source SYCL build dependencies"
           body: |
             Automated bump of the pinned open source SYCL build dependencies in
-            `os-llvm-sycl-build.yml`.
+            `.github/sycl-build-deps.env`, used by `os-llvm-sycl-build.yml`.
 
             | dependency | new value |
             | --- | --- |
diff --git a/.github/workflows/os-llvm-sycl-build.yml b/.github/workflows/os-llvm-sycl-build.yml
index bcaa2104725..9e6d41af20f 100644
--- a/.github/workflows/os-llvm-sycl-build.yml
+++ b/.github/workflows/os-llvm-sycl-build.yml
@@ -28,14 +28,29 @@ jobs:
 
     env:
       DOWNLOAD_URL_PREFIX: https://github.com/intel/llvm/releases/download
-      DRIVER_PATH: 2026-WW28
-      OCLCPUEXP_FN: oclcpuexp-2026.22.6.1.17_160000_rel.tar.gz
-      TBB_URL: https://github.com/uxlfoundation/oneTBB/releases/download/v2023.1.0/
-      TBB_INSTALL_DIR: oneapi-tbb-2023.1.0
-      TBB_FN: oneapi-tbb-2023.1.0-lin.tgz
       dpctl-repo-path: '${{ github.workspace }}/dpctl'
 
     steps:
+      - name: Checkout repo
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - name: Load pinned SYCL build deps
+        env:
+          PINS: .github/sycl-build-deps.env
+        run: |
+          set -euo pipefail
+          # Export only the expected keys.
+          VARS=$(grep -E '^(DRIVER_PATH|OCLCPUEXP_FN|TBB_URL|TBB_INSTALL_DIR|TBB_FN)=' "${PINS}" || true)
+          if [[ $(wc -l <<< "${VARS}") -ne 5 ]]; then
+              echo "::error::expected 5 pins in ${PINS}, got:"
+              echo "${VARS}"
+              exit 1
+          fi
+          echo "${VARS}" | tee -a "${GITHUB_ENV}"
+
       - name: Install hwloc
         run: sudo apt install hwloc
 
@@ -103,12 +118,6 @@ jobs:
         with:
           python-version: '3.14'
 
-      - name: Checkout repo
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-        with:
-          persist-credentials: false
-          fetch-depth: 0
-
       - name: Checkout dpctl repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: