diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 489729a5..4ce18e9e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Enforce release intent
         # The repository owner publishes this versioned shared contract.
-        uses: stella/.github/.github/actions/changeset-policy@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+        uses: stella/.github/.github/actions/changeset-policy@6a095097f5f9dc7e157ced38f978802d335baf08
         with:
           release-paths: ${{ steps.release-packages.outputs.release-paths }}
           generated-paths: ${{ steps.release-packages.outputs.generated-paths }}
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index 61d67103..7f627c2c 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -28,7 +28,7 @@ jobs:
           || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA'
         )
       )
-    uses: stella/.github/.github/workflows/cla.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/cla.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       allowlist: dependabot[bot],renovate[bot],github-actions[bot],stella-provenance-updater[bot],google-labs-jules[bot],cursoragent
     secrets:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index c7f91cdd..42440935 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -134,7 +134,7 @@ jobs:
       contents: write
       id-token: write
     # Keep this caller filename stable: npm trusted publishing authorizes it.
-    uses: stella/.github/.github/workflows/npm-independent-release.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/npm-independent-release.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       artifact-run-id: ${{ inputs.artifact_run_id || '' }}
       artifact-pattern: npm-tarball-*
diff --git a/.github/workflows/quarantine-policy.yml b/.github/workflows/quarantine-policy.yml
index ca57208a..a51e909a 100644
--- a/.github/workflows/quarantine-policy.yml
+++ b/.github/workflows/quarantine-policy.yml
@@ -15,4 +15,4 @@ jobs:
     if: github.repository == 'stella/tooling'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/quarantine-policy.yml@6a095097f5f9dc7e157ced38f978802d335baf08
diff --git a/.github/workflows/quarantine-prune.yml b/.github/workflows/quarantine-prune.yml
index 4bff4ce1..d416cc59 100644
--- a/.github/workflows/quarantine-prune.yml
+++ b/.github/workflows/quarantine-prune.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.repository == 'stella/tooling'
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/quarantine-prune.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/quarantine-prune.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     secrets:
       CHANGELOG_APP_ID: ${{ secrets.CHANGELOG_APP_ID }}
       CHANGELOG_APP_PRIVATE_KEY: ${{ secrets.CHANGELOG_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release-policy.yml b/.github/workflows/release-policy.yml
index bd521aeb..890be805 100644
--- a/.github/workflows/release-policy.yml
+++ b/.github/workflows/release-policy.yml
@@ -20,6 +20,6 @@ jobs:
     name: Enforce release boundaries
     permissions:
       contents: read
-    uses: stella/.github/.github/workflows/release-policy.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/release-policy.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       workflow: .github/workflows/publish.yml
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 0731a139..62a64cf2 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -20,7 +20,7 @@ jobs:
       pull-requests: read
       checks: read
     # The repository owner publishes this versioned shared contract.
-    uses: stella/.github/.github/workflows/changeset-release-pr.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c
+    uses: stella/.github/.github/workflows/changeset-release-pr.yml@6a095097f5f9dc7e157ced38f978802d335baf08
     with:
       bun-version-file: package.json
     secrets:
diff --git a/scripts/rust-ci.test.ts b/scripts/rust-ci.test.ts
index 9bf68891..99555d91 100644
--- a/scripts/rust-ci.test.ts
+++ b/scripts/rust-ci.test.ts
@@ -108,8 +108,10 @@ test("the required-check workflows handle merge groups and use the reviewed veri
   expect(cla["on"]["pull_request_target"]).toEqual({
     types: ["opened", "synchronize", "reopened", "ready_for_review"],
   });
-  expect(cla["jobs"]["cla"]["uses"]).toBe(
-    "stella/.github/.github/workflows/cla.yml@04c86bb54f4ae022354d72f8a40400bc7cf7428c",
+  // The pin itself belongs to Dependabot; the contract is the reviewed
+  // reusable workflow at an immutable commit.
+  expect(cla["jobs"]["cla"]["uses"]).toMatch(
+    /^stella\/\.github\/\.github\/workflows\/cla\.yml@[0-9a-f]{40}$/u,
   );
   expect(cla["jobs"]["cla"]["if"]).toContain(
     "github.event_name == 'merge_group'",