diff --git a/.github/workflows/Brewfile b/.github/workflows/Brewfile
new file mode 100644
index 00000000000000..31b144c76c1c61
--- /dev/null
+++ b/.github/workflows/Brewfile
@@ -0,0 +1,6 @@
+brew "gdbm"
+brew "make"
+brew "openssl@3.5"
+brew "pkg-config"
+brew "tcl-tk@9"
+brew "xz"
diff --git a/.github/workflows/reusable-macos.yml b/.github/workflows/reusable-macos.yml
index a372d5715290db..f88f5c2e91c513 100644
--- a/.github/workflows/reusable-macos.yml
+++ b/.github/workflows/reusable-macos.yml
@@ -37,9 +37,7 @@ jobs:
       run: echo "IMAGE_OS_VERSION=${ImageOS}-${ImageVersion}" >> "$GITHUB_ENV"
     - name: Install Homebrew dependencies
       run: |
-        brew install pkg-config openssl@3.5 xz gdbm tcl-tk@9 make
-        # Because alternate versions are not symlinked into place by default:
-        brew link --overwrite tcl-tk@9
+        brew bundle --file=.github/workflows/Brewfile
     - name: Configure CPython
       run: |
         MACOSX_DEPLOYMENT_TARGET=10.15 \
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index c77610e209ebbd..e373096082ad46 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -85,6 +85,8 @@ repos:
         exclude: Lib/test/tokenizedata/coding20731.py
       - id: end-of-file-fixer
         files: '^\.github/CODEOWNERS$'
+      - id: file-contents-sorter
+        files: '^\.github/workflows/Brewfile$'
       - id: trailing-whitespace
         types_or: [c, inc, python, rst, yaml]
       - id: trailing-whitespace