diff --git a/.github/workflows/maintenance-sync-standards.yml b/.github/workflows/maintenance-sync-standards.yml
index 2a90cd72..c1d36b8b 100644
--- a/.github/workflows/maintenance-sync-standards.yml
+++ b/.github/workflows/maintenance-sync-standards.yml
@@ -30,7 +30,7 @@ jobs:
   maintenance-sync-standards:
     # Real runs attest App access for the complete unfiltered manifest before
     # mutation; `targets` limits reconciliation only, never attestation.
-    uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/maintenance-sync-standards.yml@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
     with:
       runner: ubuntu-24.04
       # Schedule and push run for real (inputs is empty on those events, so
diff --git a/.github/workflows/pr-review-security.yml b/.github/workflows/pr-review-security.yml
index fdb87427..385950ce 100644
--- a/.github/workflows/pr-review-security.yml
+++ b/.github/workflows/pr-review-security.yml
@@ -41,7 +41,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
     with:
       # DEVIATION from the component, which names the managed fleet label:
       # this repository is PUBLIC, and runner-policy admits a managed label
diff --git a/.github/workflows/pr-review.yml b/.github/workflows/pr-review.yml
index 21714516..674bba10 100644
--- a/.github/workflows/pr-review.yml
+++ b/.github/workflows/pr-review.yml
@@ -49,7 +49,7 @@ jobs:
       pull-requests: write   # post review + track_progress tracking comment
       id-token: write        # OIDC — mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
     with:
       # DEVIATION from the component, which names the managed fleet label:
       # this repository is PUBLIC, and runner-policy admits a fleet label only
diff --git a/components/claude-lanes-hosted/claude-review.yml b/components/claude-lanes-hosted/claude-review.yml
index 22109777..c6ea0c63 100644
--- a/components/claude-lanes-hosted/claude-review.yml
+++ b/components/claude-lanes-hosted/claude-review.yml
@@ -80,7 +80,7 @@ jobs:
                              # reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
     with:
       runner: ubuntu-24.04
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/claude-lanes-hosted/claude-security-review.yml b/components/claude-lanes-hosted/claude-security-review.yml
index d49727ee..0c64527c 100644
--- a/components/claude-lanes-hosted/claude-security-review.yml
+++ b/components/claude-lanes-hosted/claude-security-review.yml
@@ -81,7 +81,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
     with:
       runner: ubuntu-24.04
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/claude-lanes/claude-review.yml b/components/claude-lanes/claude-review.yml
index 98c977ca..0c513f23 100644
--- a/components/claude-lanes/claude-review.yml
+++ b/components/claude-lanes/claude-review.yml
@@ -75,7 +75,7 @@ jobs:
                              # reviewed-head marker comment
       id-token: write        # OIDC, mints the Claude GitHub App token (required
                              # even with an OAuth/API-key credential)
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review.yml@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
     with:
       runner: melodic-review-ubuntu-24.04-x64
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/claude-lanes/claude-security-review.yml b/components/claude-lanes/claude-security-review.yml
index b83e1600..0896a2f8 100644
--- a/components/claude-lanes/claude-security-review.yml
+++ b/components/claude-lanes/claude-security-review.yml
@@ -77,7 +77,7 @@ jobs:
     concurrency:
       group: pr-review-security-${{ github.event.pull_request.number || github.run_id }}
       cancel-in-progress: false
-    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+    uses: melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
     with:
       runner: melodic-review-ubuntu-24.04-x64
     # Pass only the one named secret (least privilege) rather than
diff --git a/components/managed-files-guard/managed-files-guard-fleet.yml b/components/managed-files-guard/managed-files-guard-fleet.yml
index bcad38a7..32e87054 100644
--- a/components/managed-files-guard/managed-files-guard-fleet.yml
+++ b/components/managed-files-guard/managed-files-guard-fleet.yml
@@ -128,7 +128,7 @@ jobs:
         # now contains that commit, so the pin-comment takes the convention's
         # release-tag form rather than the short-SHA fallback
         # (components/managed-files-guard/README.md).
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read
diff --git a/components/managed-files-guard/managed-files-guard.yml b/components/managed-files-guard/managed-files-guard.yml
index f6989006..478bfbc4 100644
--- a/components/managed-files-guard/managed-files-guard.yml
+++ b/components/managed-files-guard/managed-files-guard.yml
@@ -111,7 +111,7 @@ jobs:
         # now contains that commit, so the pin-comment takes the convention's
         # release-tag form rather than the short-SHA fallback
         # (components/managed-files-guard/README.md).
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@ab83b01273026ab5c23c6f3b40e946d97a863fa2 # v0.39.3
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@594987abe8657a40bccc13d301f1f0d5cccb5348 # v0.39.8
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read