diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md
index 9b04b336..090fce4e 100644
--- a/components/runner-policy/README.md
+++ b/components/runner-policy/README.md
@@ -1353,6 +1353,13 @@ v0.55.0 entry. Its `workflow_call` inputs, secrets, top-level and job
 permissions and `runs-on` are unchanged; a new report step lists timeouts and
 accepted 429 and 5xx links in the job summary (ci-workflows#844). No input,
 secret, caller permission, or routing changes.
+At the v0.59.1 tag `8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b`, sign-off
+pending, `pr-review` and `pr-review-security` are verbatim copies of their
+v0.55.0 entries. Their `workflow_call` inputs, secrets and permissions are
+unchanged; the claude-code-action pin moves from v1.0.252 to v1.0.253 on both
+review steps, which receive the OAuth token (ci-workflows#838), and the
+findings count is raised to the summary's manifest flag lines
+(ci-workflows#848). No input, secret, caller permission, or routing changes.
 The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
 uses its reviewed `runner` input and checksum-verified native Linux binary, so
 enrolled consumers may route that advisory lane onto the managed fleet
diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index bc86a4a8..b078fb3d 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -391,6 +391,25 @@
         "id-token": "write"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review.yml@8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "allowedInputs": [
+        "runner",
+        "incremental-review",
+        "allowed-bot-sender-ids",
+        "model-args",
+        "allowed-author-ids"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
+      },
+      "allowedCallerPermissions": {
+        "contents": "read",
+        "pull-requests": "write",
+        "id-token": "write"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
@@ -547,6 +566,19 @@
         "id-token": "write"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review-security.yml@8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "allowedInputs": ["runner", "incremental-review", "allowed-bot-sender-ids", "model-args"],
+      "allowedSecrets": {
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}"
+      },
+      "allowedCallerPermissions": {
+        "contents": "read",
+        "pull-requests": "write",
+        "id-token": "write"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index 427eab16..5a16c75d 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -53,6 +53,7 @@ const REPINE_LANE_SHA_V0_55_0 = "3a2c748fdef9cfb9ceec5a66289e21842189689f";
 const REPINE_LANE_SHA_V0_56_0 = "1bb8953644d16f21d10718962c6702f01ea3308a";
 const REPINE_LANE_SHA_V0_58_0 = "5e18f3d6cebd6fa5e66b0941ee0f7ed6ba288d6c";
 const REPINE_LANE_SHA_V0_59_0 = "4aff99320ef484a7beac35ee3a7b7b854ec1e33f";
+const REPINE_LANE_SHA_V0_59_1 = "8bd4d7f963a06627dd2d551ffcd8d9db5e6b881b";
 const STANDARDS_SYNC_SHA = "35f2684ac953794b854bac1959df00e74eeca1d9";
 const REUSABLE_PATH = "melodic-software/ci-workflows/.github/workflows/osv-scanner.yml";
 const REUSABLE_REFERENCE = `${REUSABLE_PATH}@${SHA}`;
@@ -9617,6 +9618,30 @@ test("the online link-check contract at the v0.59.0 tag copies its v0.55.0 entry
   );
 });
 
+// v0.59.1 keeps both review interfaces: inputs, secrets and permissions are
+// unchanged; the claude-code-action pin moves from v1.0.252 to v1.0.253 on the
+// steps that receive the OAuth token (ci-workflows#838) and the findings count
+// is raised to the summary's manifest flag lines (ci-workflows#848), so each
+// v0.55.0 entry carries forward verbatim.
+test("both review contracts at the v0.59.1 tag copy their v0.55.0 entries forward verbatim", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const reusables = ["pr-review", "pr-review-security"];
+  for (const reusable of reusables) {
+    const workflowPath = `melodic-software/ci-workflows/.github/workflows/${reusable}.yml`;
+    const previous = contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_55_0}`];
+    assert.ok(previous, `expected a v0.55.0 contract for ${reusable}`);
+    assert.deepEqual(
+      contracts[`${workflowPath}@${REPINE_LANE_SHA_V0_59_1}`],
+      previous,
+      `${reusable} at the v0.59.1 tag is not a verbatim copy of its v0.55.0 entry`,
+    );
+  }
+  assert.equal(
+    Object.keys(contracts).filter((key) => key.endsWith(`@${REPINE_LANE_SHA_V0_59_1}`)).length,
+    reusables.length,
+  );
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on