diff --git a/.github/workflows/pr-review-hosted.yml b/.github/workflows/pr-review-hosted.yml
index 3b30838313..8908c7d9b7 100644
--- a/.github/workflows/pr-review-hosted.yml
+++ b/.github/workflows/pr-review-hosted.yml
@@ -166,7 +166,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@914264587c35692c15e05c965103426eec18d1f0 # v0.65.6
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d # v0.65.7
     with:
       lane: code
       publish: comments
@@ -189,9 +189,10 @@ jobs:
       # change, documentation included.
       docs-only-paths: ''
       # A hold adds this label and a `claude-lane-hold` marker comment; ci-status
-      # fails while the label is on. The review holds only for its hold
-      # classes; a changed file matching hold-paths holds as trust-gate
-      # whatever the review says. Keep both lists equal in the two callers.
+      # fails while the label is on. The review holds only for a real-charge
+      # cost or a CRITICAL security finding; hold-paths names the files the
+      # prompt sends to extra security scrutiny and never holds by itself.
+      # Keep both lists equal in the two callers.
       hold-label: needs-human
       hold-paths: |
         .github/standards/trusted-actors/**
diff --git a/.github/workflows/pr-review-security-hosted.yml b/.github/workflows/pr-review-security-hosted.yml
index 2bcb2e9ad4..14a886c290 100644
--- a/.github/workflows/pr-review-security-hosted.yml
+++ b/.github/workflows/pr-review-security-hosted.yml
@@ -171,7 +171,7 @@ jobs:
       contents: read
       pull-requests: write   # the review, its inline comments and the lane's
                              # reviewed-head marker comment
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@914264587c35692c15e05c965103426eec18d1f0 # v0.65.6
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d # v0.65.7
     with:
       lane: security
       publish: comments
@@ -189,9 +189,10 @@ jobs:
       # no findings binds to the head and scores low.
       docs-only-paths: ''
       # A hold adds this label and a `claude-lane-hold` marker comment; ci-status
-      # fails while the label is on. The review holds only for its hold
-      # classes; a changed file matching hold-paths holds as trust-gate
-      # whatever the review says. Keep both lists equal in the two callers.
+      # fails while the label is on. The review holds only for a real-charge
+      # cost or a CRITICAL security finding; hold-paths names the files the
+      # prompt sends to extra security scrutiny and never holds by itself.
+      # Keep both lists equal in the two callers.
       hold-label: needs-human
       hold-paths: |
         .github/standards/trusted-actors/**
diff --git a/scripts/ci-review-lanes.test.sh b/scripts/ci-review-lanes.test.sh
index a045927f59..1bba418917 100755
--- a/scripts/ci-review-lanes.test.sh
+++ b/scripts/ci-review-lanes.test.sh
@@ -76,10 +76,10 @@ for pair in 'pr-review-hosted.yml pr-review:' 'pr-review-security-hosted.yml pr-
   caller="$ROOT/.github/workflows/$file"
   if grep -qxF "  $job" "$caller" && grep -qxF '      publish: comments' "$caller" &&
     grep -qxF '      hold-label: needs-human' "$caller" &&
-    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@914264587c35692c15e05c965103426eec18d1f0 # v0\.65\.6$' "$caller"; then
-    ok "$file calls pr-review-cli v0.65.6 as job ${job%:} with publish: comments and hold-label: needs-human"
+    grep -qE '^    uses: melodic-software/ci-workflows/\.github/workflows/pr-review-cli\.yml@4c531cea137f5cbb38d4c132dbfa6e38f76fba7d # v0\.65\.7$' "$caller"; then
+    ok "$file calls pr-review-cli v0.65.7 as job ${job%:} with publish: comments and hold-label: needs-human"
   else
-    fail "$file lost its job id, publish: comments, hold-label or v0.65.6 pin"
+    fail "$file lost its job id, publish: comments, hold-label or v0.65.7 pin"
   fi
   paths="$(awk '/^      hold-paths: \|$/ { on = 1; next } on && /^        / { sub(/^ +/, ""); print; next } on { exit }' "$caller")"
   if [[ "$paths" == $'.github/standards/trusted-actors/**\n.github/actions/check-trusted-trigger/**\n**/CODEOWNERS\n**/.gitmodules' ]]; then