diff --git a/plugins/magpie-security/skills/issue-sync/apply-and-push.md b/plugins/magpie-security/skills/issue-sync/apply-and-push.md
index 58fea1202..0bf6bce9c 100644
--- a/plugins/magpie-security/skills/issue-sync/apply-and-push.md
+++ b/plugins/magpie-security/skills/issue-sync/apply-and-push.md
@@ -521,7 +521,7 @@ the four gates that need judgement (trigger conditions, the incomplete-fix claus
 
    ```bash
    uv run --project <framework>/tools/cve-tool-vulnogram/oauth-api vulnogram-api-record-fetch \
-     --cve-id <CVE-ID> --jq '.body.CNA_private.state'
+     --cve-id <CVE-ID> --state-only
    ```
 
    If that fetch entrypoint is not yet installed on the operator's machine (see [`tools/cve-tool-vulnogram/oauth-api/README.md`](../../../../tools/cve-tool-vulnogram/oauth-api/README.md)),
diff --git a/tools/security-management/src/security_management/issue_sync/push.py b/tools/security-management/src/security_management/issue_sync/push.py
index 57d010347..03e853396 100644
--- a/tools/security-management/src/security_management/issue_sync/push.py
+++ b/tools/security-management/src/security_management/issue_sync/push.py
@@ -176,7 +176,7 @@ def out(action: str, why: str, **extra: Any) -> dict[str, Any]:
             return out(
                 "pending",
                 "verify the state advance",
-                next=f"uv run --project {oauth_api} vulnogram-api-record-fetch --cve-id {w(cve_id)} --jq '.body.CNA_private.state'",
+                next=f"uv run --project {oauth_api} vulnogram-api-record-fetch --cve-id {w(cve_id)} --state-only",
             )
         if fetched in LATER:
             return out(
diff --git a/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md b/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md
index 47d11a6ac..de30832b2 100644
--- a/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md
+++ b/tools/skill-evals/evals/security-issue-sync/step-5b-judged-gates/fixtures/case-5-clean-push-fix-released/report.md
@@ -32,5 +32,5 @@ asked to be credited. Not a follow-up to any earlier CVE.
 
 Adapter session probe (`vulnogram-api-check`): `valid`.
 `vulnogram-api-record-update`: exit 0 at 2026-10-03T14:12:09Z.
-`vulnogram-api-record-fetch --jq '.body.CNA_private.state'`: `"REVIEW"`
+`vulnogram-api-record-fetch --state-only`: `REVIEW`
 (normalised: `review-ready`).