diff --git a/.github/workflows/drafter.lock.yml b/.github/workflows/drafter.lock.yml
index c73c41e..68481ca 100644
--- a/.github/workflows/drafter.lock.yml
+++ b/.github/workflows/drafter.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"3a0bbf28d510b3b0e9555fdd41749df26bec70e9b0acb5fee8dc6b8410a832a6","body_hash":"b00b4ebed44820c9bce14005f6b610bef49095ccfeda4781affaf5853e968b79","compiler_version":"v0.81.6","strict":true,"agent_id":"claude","agent_model":"claude-sonnet-4-5-20250929","engine_versions":{"claude":"2.1.191"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"3a0bbf28d510b3b0e9555fdd41749df26bec70e9b0acb5fee8dc6b8410a832a6","body_hash":"75c72a7ba37439592a789316e8a5bc2fe4140865b32fecfabf98c7cea9fc6043","compiler_version":"v0.81.6","strict":true,"agent_id":"claude","agent_model":"claude-sonnet-4-5-20250929","engine_versions":{"claude":"2.1.191"}}
 # gh-aw-manifest: {"version":1,"secrets":["ANTHROPIC_API_KEY","GH_AW_APP_PRIVATE_KEY","GH_AW_CI_TRIGGER_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/cache/restore","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/cache/save","sha":"27d5ce7f107fe9357f9df03efb73ab90386fccae","version":"v5.0.5"},{"repo":"actions/checkout","sha":"9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0","version":"v7.0.0"},{"repo":"actions/create-github-app-token","sha":"bcd2ba49218906704ab6c1aa796996da409d3eb1","version":"v3.2.0"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"ba6380cc6e5be5d21677bebe04d52fb48e3abec7","version":"v0.81.6"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.11","digest":"sha256:979723c628182da7729333f2208bb249fd25ddee579645cf9a3892d681a929c7","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.11@sha256:979723c628182da7729333f2208bb249fd25ddee579645cf9a3892d681a929c7"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.11","digest":"sha256:807e4831999b44513b0a66e5859d478dc4da7ae74ab1918cec967d513f95bf9d","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.11@sha256:807e4831999b44513b0a66e5859d478dc4da7ae74ab1918cec967d513f95bf9d"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.11","digest":"sha256:ff27ea0525ad953a6adee28a5fbe9d2e22be47dbec755c15767af4ea3f91df7d","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.11@sha256:ff27ea0525ad953a6adee28a5fbe9d2e22be47dbec755c15767af4ea3f91df7d"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.30","digest":"sha256:35625d1a2269b1238606078c879f59a91cffc4ac33eb54bf39c6418822c1a8be","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.30@sha256:35625d1a2269b1238606078c879f59a91cffc4ac33eb54bf39c6418822c1a8be"},{"image":"ghcr.io/github/gh-aw-node","digest":"sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b","pinned_image":"ghcr.io/github/gh-aw-node@sha256:529d02eb970b1161aa25c593a9c3df57fdfad5a8add328cb3b6eccef66f3183b"},{"image":"ghcr.io/github/github-mcp-server:v1.4.0","digest":"sha256:2afb26356481d1a350e14544a6e160f7f7ec1561a1ea309b823665abf0309036","pinned_image":"ghcr.io/github/github-mcp-server:v1.4.0@sha256:2afb26356481d1a350e14544a6e160f7f7ec1561a1ea309b823665abf0309036"}]}
 # This file was automatically generated by gh-aw (v0.81.6). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
diff --git a/.github/workflows/drafter.md b/.github/workflows/drafter.md
index e5a43f3..305f8db 100644
--- a/.github/workflows/drafter.md
+++ b/.github/workflows/drafter.md
@@ -157,9 +157,15 @@ implementation.
    lockfiles before opening the pull request: run `just setup && just
    compile` (this recompiles *all* workflows, not just the one you touched —
    every `.lock.yml` must stay in sync with its `.md` source).
-6. Once validation passes, open a pull request via the `create-pull-request`
+6. Check if the originating issue #${{ github.event.issue.number }} has the
+   `agent/workflow-edits-allowed` label by reading its labels. If it does,
+   you must propagate this label to the pull request so that subsequent
+   fix iterations (via `fix.md`) can also push changes to protected files.
+7. Once validation passes, open a pull request via the `create-pull-request`
    safe-output. The PR description should summarize the change and state
-   how it was validated.
+   how it was validated. If the originating issue has the 
+   `agent/workflow-edits-allowed` label (checked in step 6), pass it in the
+   `labels` parameter when creating the PR.
 
 ## Constraints