diff --git a/.github/workflows/clean_validation_envs.yml b/.github/workflows/clean_validation_envs.yml
index 4069d1dc4..162d5f8c3 100644
--- a/.github/workflows/clean_validation_envs.yml
+++ b/.github/workflows/clean_validation_envs.yml
@@ -28,6 +28,15 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      - name: Install specific Azure CLI version
+        run: |
+          AZ_DIST=$(lsb_release -cs)
+          AZ_VER=2.81.0
+
+          apt-cache policy azure-cli
+          sudo apt-get install azure-cli="${AZ_VER}-1~${AZ_DIST}" --allow-downgrades
+          az version
+
       - name: Azure Login
         uses: azure/login@532459ea530d8321f2fb9bb10d1e0bcf23869a43 # v3.0.0
         with:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7666f07aa..bd43b24ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,6 +19,7 @@ BUG FIXES:
 * Fix dependabot high moderate alerts for packages aiohttp and pytest, pytest-asyncio
 * Fix spelling in docs using codespell ([#4954](https://github.com/microsoft/AzureTRE/issues/4954))
 * Replace deprecated yaspell with codespell and add pre-commit hook installer to devcontainer. ([#4953](https://github.com/microsoft/AzureTRE/issues/4953))
+* Fix Clean Validation workflow by pinning the Azure CLI version to avoid transient checksum errors from unpinned Azure CLI packages ([#4971](https://github.com/microsoft/AzureTRE/issues/4971))
 
 ## (0.28.0) (March 2, 2026)
 **BREAKING CHANGES**