diff --git a/components/runner-policy/README.md b/components/runner-policy/README.md
index b21bbe5a..14417d2d 100644
--- a/components/runner-policy/README.md
+++ b/components/runner-policy/README.md
@@ -1444,6 +1444,10 @@ contracts copy their v0.65.11 entries forward and add one secret,
 third job triages or reviews on the central fallback subscription after the
 subscription job hands off (ci-workflows#890), with no input, permission or
 routing change.
+At the v0.65.13 tag `ba7af78d291f10bd75651857a0db2357c23df0fe`, both
+contracts copy their v0.65.12 entries forward unchanged: the release fixes
+the pr-review-cli status job's read of the counted token leg's job result
+(ci-workflows#892), with no input, secret, permission or routing change.
 The Zizmor contract at `de50a08b6093d231519ee7a4c9371db76c0a7e1e`
 uses its reviewed `runner` input and checksum-verified native Linux binary, so
 enrolled consumers may route that advisory lane onto the managed fleet
diff --git a/components/runner-policy/policy.json b/components/runner-policy/policy.json
index a43fe302..786b4c3e 100644
--- a/components/runner-policy/policy.json
+++ b/components/runner-policy/policy.json
@@ -438,6 +438,33 @@
         "issues": "write"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/intake-triage.yml@ba7af78d291f10bd75651857a0db2357c23df0fe": {
+      "routing": "runner-input",
+      "runnerInput": "runner",
+      "role": "intake",
+      "allowedInputs": [
+        "runner",
+        "allowed-labels",
+        "escalation-label",
+        "floor-label",
+        "instructions",
+        "cli-version",
+        "claude-args",
+        "issue-number",
+        "allowed-author-ids",
+        "allowed-bot-sender-ids",
+        "role"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.INTAKE_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.INTAKE_CLAUDE_CODE_OAUTH_TOKEN }}",
+        "FALLBACK_CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}"
+      },
+      "allowedCallerPermissions": {
+        "contents": "read",
+        "issues": "write"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/pr-review.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
@@ -1238,6 +1265,28 @@
         "FALLBACK_CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}"
       }
     },
+    "melodic-software/ci-workflows/.github/workflows/pr-review-cli.yml@ba7af78d291f10bd75651857a0db2357c23df0fe": {
+      "routing": "hosted-only",
+      "fixedRunsOn": ["ubuntu-24.04"],
+      "allowedInputs": [
+        "lane",
+        "publish",
+        "role",
+        "model-args",
+        "allowed-bot-sender-ids",
+        "allowed-author-ids",
+        "docs-only-paths",
+        "incremental-review",
+        "cli-version",
+        "hold-label",
+        "hold-paths"
+      ],
+      "allowedSecrets": {
+        "CLAUDE_API_KEY": "${{ secrets.REVIEWS_CLAUDE_API_KEY }}",
+        "CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.REVIEWS_CLAUDE_CODE_OAUTH_TOKEN }}",
+        "FALLBACK_CLAUDE_CODE_OAUTH_TOKEN": "${{ secrets.FALLBACK_CLAUDE_CODE_OAUTH_TOKEN }}"
+      }
+    },
     "melodic-software/ci-workflows/.github/workflows/intake-label-needs-triage.yml@ab83b01273026ab5c23c6f3b40e946d97a863fa2": {
       "routing": "runner-input",
       "runnerInput": "runner",
diff --git a/components/runner-policy/runner-policy.test.mjs b/components/runner-policy/runner-policy.test.mjs
index 0b12778e..70f53412 100644
--- a/components/runner-policy/runner-policy.test.mjs
+++ b/components/runner-policy/runner-policy.test.mjs
@@ -10122,6 +10122,21 @@ test("the intake-triage and pr-review-cli contracts at the v0.65.12 tag add only
   assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 2);
 });
 
+// v0.65.13 fixes the pr-review-cli status job's token-leg result output
+// (ci-workflows#892): no input, secret or permission changes, so both
+// entries copy v0.65.12 forward unchanged.
+test("the intake-triage and pr-review-cli contracts at the v0.65.13 tag copy their v0.65.12 entries unchanged", () => {
+  const contracts = BASE_POLICY.approvedReusableWorkflowContracts;
+  const key = (wf, sha) => `melodic-software/ci-workflows/.github/workflows/${wf}@${sha}`;
+  const sha = "ba7af78d291f10bd75651857a0db2357c23df0fe";
+  const previous = "78ee7a2609a84b0073c5e09dfe3bc59613e689dc";
+  for (const wf of ["intake-triage.yml", "pr-review-cli.yml"]) {
+    assert.ok(contracts[key(wf, previous)], wf);
+    assert.deepEqual(contracts[key(wf, sha)], contracts[key(wf, previous)], wf);
+  }
+  assert.equal(Object.keys(contracts).filter((k) => k.endsWith(`@${sha}`)).length, 2);
+});
+
 // Convergence as a property, never as a hardcoded SHA. The daily
 // claude-lanes-repin lane rewrites these components on every ci-workflows
 // release, and a test naming one revision would go red by construction on