diff --git a/.github/workflows/pr-review-fix-scheduler.yml b/.github/workflows/pr-review-fix-scheduler.yml
index cc7875bc8..154f7db83 100644
--- a/.github/workflows/pr-review-fix-scheduler.yml
+++ b/.github/workflows/pr-review-fix-scheduler.yml
@@ -44,9 +44,9 @@ on:
         default: ""
         type: string
       canonical_ref:
-        description: Ref of ContextualWisdomLab/.github to use for scheduler code
+        description: Deprecated compatibility input; the called workflow's immutable SHA is always used
         required: false
-        default: "main"
+        default: ""
         type: string
   repository_dispatch:
     types: [pr-review-fix-scheduler]
@@ -81,14 +81,27 @@ jobs:
       MAX_PRS: ${{ github.event.client_payload.max_prs || inputs.max_prs || '50' }}
       MAX_DISPATCHES: ${{ github.event.client_payload.max_dispatches || inputs.max_dispatches || '1' }}
       RETRY_HOURS: ${{ github.event.client_payload.retry_hours || inputs.retry_hours || '24' }}
-      AUTOFIX_WORKFLOW: pr-review-autofix.yml
-      AUTOFIX_REPOSITORY: ContextualWisdomLab/.github
-      CANONICAL_REF: main
+      AUTOFIX_WORKFLOW: ${{ github.event.client_payload.autofix_workflow || inputs.autofix_workflow || 'pr-review-autofix.yml' }}
+      AUTOFIX_REPOSITORY: ${{ github.event.client_payload.autofix_repository || inputs.autofix_repository || 'ContextualWisdomLab/.github' }}
+      CANONICAL_REPOSITORY: ${{ job.workflow_repository }}
+      CANONICAL_REF: ${{ job.workflow_sha }}
     steps:
+      - name: Require immutable canonical source
+        run: |
+          set -euo pipefail
+          if [ "$CANONICAL_REPOSITORY" != "ContextualWisdomLab/.github" ]; then
+            echo "::error::Canonical scheduler source resolved outside ContextualWisdomLab/.github."
+            exit 1
+          fi
+          if [[ ! "$CANONICAL_REF" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::Canonical scheduler source must resolve to the immutable called-workflow commit SHA."
+            exit 1
+          fi
+
       - name: Checkout canonical scheduler
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
-          repository: ContextualWisdomLab/.github
+          repository: ${{ env.CANONICAL_REPOSITORY }}
           ref: ${{ env.CANONICAL_REF }}
           fetch-depth: 1
           persist-credentials: false