diff --git a/.github/workflows/maintenance-sync-standards.yml b/.github/workflows/maintenance-sync-standards.yml
index 4ee94fcc..2a793d9e 100644
--- a/.github/workflows/maintenance-sync-standards.yml
+++ b/.github/workflows/maintenance-sync-standards.yml
@@ -30,7 +30,7 @@ jobs:
   maintenance-sync-standards:
     # Real runs attest App access for the complete unfiltered manifest before
     # mutation; `targets` limits reconciliation only, never attestation.
-    uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
     with:
       runner: ubuntu-24.04
       # Schedule and push run for real (inputs is empty on those events, so
diff --git a/.github/workflows/pr-review-security.yml b/.github/workflows/pr-review-security.yml
index 675f5430..be82024d 100644
--- a/.github/workflows/pr-review-security.yml
+++ b/.github/workflows/pr-review-security.yml
@@ -41,7 +41,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
     with:
       # DEVIATION from the component, which names the managed fleet label:
       # this repository is PUBLIC, and runner-policy admits a managed label
diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 805e4905..b1e32b40 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -49,7 +49,7 @@ jobs:
       pull-requests: write   # post review + track_progress tracking comment
       id-token: write        # OIDC — mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
     with:
       # DEVIATION from the component, which names the managed fleet label:
       # this repository is PUBLIC, and runner-policy admits a fleet label only
diff --git a/components/claude-lanes-hosted/claude-review.yml b/components/claude-lanes-hosted/claude-review.yml
index ffd120b4..986b7358 100644
--- a/components/claude-lanes-hosted/claude-review.yml
+++ b/components/claude-lanes-hosted/claude-review.yml
@@ -80,7 +80,7 @@ jobs:
                              # reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
     with:
       runner: ubuntu-24.04
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/claude-lanes-hosted/claude-security-review.yml b/components/claude-lanes-hosted/claude-security-review.yml
index 2d3f979b..8ef2be26 100644
--- a/components/claude-lanes-hosted/claude-security-review.yml
+++ b/components/claude-lanes-hosted/claude-security-review.yml
@@ -81,7 +81,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
     with:
       runner: ubuntu-24.04
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/claude-lanes/claude-review.yml b/components/claude-lanes/claude-review.yml
index c79a46c0..7ce5ba89 100644
--- a/components/claude-lanes/claude-review.yml
+++ b/components/claude-lanes/claude-review.yml
@@ -75,7 +75,7 @@ jobs:
                              # reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
     with:
       runner: melodic-review-ubuntu-24.04-x64
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/claude-lanes/claude-security-review.yml b/components/claude-lanes/claude-security-review.yml
index 8a7628a1..c688d0be 100644
--- a/components/claude-lanes/claude-security-review.yml
+++ b/components/claude-lanes/claude-security-review.yml
@@ -77,7 +77,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
     with:
       runner: melodic-review-ubuntu-24.04-x64
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/managed-files-guard/managed-files-guard-fleet.yml b/components/managed-files-guard/managed-files-guard-fleet.yml
index 44e60000..da854fd3 100644
--- a/components/managed-files-guard/managed-files-guard-fleet.yml
+++ b/components/managed-files-guard/managed-files-guard-fleet.yml
@@ -118,7 +118,7 @@ jobs:
         # now contains that commit, so the pin-comment takes the convention's
         # release-tag form rather than the short-SHA fallback
         # (components/managed-files-guard/README.md).
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read
diff --git a/components/managed-files-guard/managed-files-guard.yml b/components/managed-files-guard/managed-files-guard.yml
index f37cfb74..509b5a3f 100644
--- a/components/managed-files-guard/managed-files-guard.yml
+++ b/components/managed-files-guard/managed-files-guard.yml
@@ -102,7 +102,7 @@ jobs:
         # now contains that commit, so the pin-comment takes the convention's
         # release-tag form rather than the short-SHA fallback
         # (components/managed-files-guard/README.md).
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@6ba73b97b058602c4dd2bb6e2cce234d11011787 # v0.39.0
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@c586acc8ea288d728cc7d92f641161eec462fa05 # v0.39.1
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read