diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c1de5f44..d8f1ecae 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -146,7 +146,7 @@ jobs:
       - name: Run coarse performance smoke benchmark
         run: |
           ./mvnw -B -ntp -f benchmarks/pom.xml -DskipTests \
-            "org.codehaus.mojo:exec-maven-plugin:3.5.0:java" \
+            exec:java \
             "-Dexec.mainClass=com.demcha.compose.CurrentSpeedBenchmark" \
             "-Dgraphcompose.benchmark.profile=smoke"
 
@@ -194,7 +194,7 @@ jobs:
       - name: Run full benchmark suite
         run: |
           ./mvnw -B -ntp -f benchmarks/pom.xml -DskipTests \
-            "org.codehaus.mojo:exec-maven-plugin:3.5.0:java" \
+            exec:java \
             "-Dexec.mainClass=com.demcha.compose.CurrentSpeedBenchmark" \
             "-Dgraphcompose.benchmark.profile=full" \
             "-Dgraphcompose.benchmark.enforceGate=false"
@@ -212,7 +212,7 @@ jobs:
         if: steps.benchmark-runs.outputs.count != '0' && steps.benchmark-runs.outputs.count != '1'
         run: |
           ./mvnw -B -ntp -f benchmarks/pom.xml -DskipTests \
-            "org.codehaus.mojo:exec-maven-plugin:3.5.0:java" \
+            exec:java \
             "-Dexec.mainClass=com.demcha.compose.BenchmarkDiffTool" \
             "-Dexec.args=current-speed"
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fcbbbce0..85f0fd53 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -58,6 +58,15 @@ follow semantic versioning; release dates are ISO 8601.
   though no production code references it. Setting `<scope>test</scope>`
   keeps the version pin but keeps `byte-buddy` out of consumers' runtime
   classpath (`mvn dependency:tree` shows it only as `:test`).
+- **CI `exec-maven-plugin` version drift removed.** The CI workflow's
+  three benchmark steps invoked
+  `org.codehaus.mojo:exec-maven-plugin:3.5.0:java` directly, while
+  `benchmarks/pom.xml` already declared `exec-maven-plugin` at `3.6.3`
+  for local runs — a silent version split between CI and local invocations
+  that grew the surface area to keep aligned. CI now calls the configured
+  plugin via `exec:java`, picking up the pinned `3.6.3` from
+  `benchmarks/pom.xml`. No behaviour change; one fewer hardcoded version
+  to bump.
 
 ## v1.6.4 — 2026-05-22