diff --git a/.github/workflows/github-governance-auto-onboard.yml b/.github/workflows/github-governance-auto-onboard.yml
index 80df3e9..d8cc039 100644
--- a/.github/workflows/github-governance-auto-onboard.yml
+++ b/.github/workflows/github-governance-auto-onboard.yml
@@ -70,7 +70,7 @@ jobs:
           permission-administration: write
 
       - name: Create missing default ruleset only
-        uses: LibreCodeCoop/github-governance@76fcdc8ae250c81aeb055533c2741385ac9f0b7b # pinned reviewed baseline-only engine
+        uses: LibreCodeCoop/github-governance@1f0e4a80cf44cd6762eb3d0144200fd51fc2b07d # pinned reviewed baseline-only engine
         with:
           token: ${{ steps.app-token.outputs.token }}
           contents-token: ${{ github.token }}
diff --git a/.github/workflows/github-governance.yml b/.github/workflows/github-governance.yml
index d0b7964..7131d00 100644
--- a/.github/workflows/github-governance.yml
+++ b/.github/workflows/github-governance.yml
@@ -47,7 +47,7 @@ jobs:
           persist-credentials: false
 
       - name: Plan repository governance (read only)
-        uses: LibreCodeCoop/github-governance@76fcdc8ae250c81aeb055533c2741385ac9f0b7b # public planning support; pin immutable commit
+        uses: LibreCodeCoop/github-governance@1f0e4a80cf44cd6762eb3d0144200fd51fc2b07d # public planning support; pin immutable commit
         with:
           token: ${{ github.token }}
           organization: ${{ inputs.repository == '' && 'LibreCodeCoop' || '' }}
@@ -86,7 +86,7 @@ jobs:
           # The privileged GitHub App must not require Contents permission.
 
       - name: Apply repository governance
-        uses: LibreCodeCoop/github-governance@76fcdc8ae250c81aeb055533c2741385ac9f0b7b # public planning support; pin immutable commit
+        uses: LibreCodeCoop/github-governance@1f0e4a80cf44cd6762eb3d0144200fd51fc2b07d # public planning support; pin immutable commit
         with:
           token: ${{ steps.app-token.outputs.token }}
           contents-token: ${{ github.token }}
diff --git a/tests/test_governance_auto_onboarding.py b/tests/test_governance_auto_onboarding.py
index 54b4248..8654707 100644
--- a/tests/test_governance_auto_onboarding.py
+++ b/tests/test_governance_auto_onboarding.py
@@ -97,6 +97,18 @@ def test_matrix_size_is_bounded(self):
         with self.assertRaisesRegex(ValueError, "Too many candidates"):
             module.discover(api, "LibreCodeCoop")
 
+    def test_governance_workflows_share_reviewed_engine_pin(self):
+        import re
+
+        primary = (ROOT / ".github/workflows/github-governance.yml").read_text(encoding="utf-8")
+        onboarding = WORKFLOW.read_text(encoding="utf-8")
+        pattern = r"uses: LibreCodeCoop/github-governance@([0-9a-f]{40})"
+        main_pins = re.findall(pattern, primary)
+        onboarding_pins = re.findall(pattern, onboarding)
+        self.assertEqual(len(main_pins), 2)
+        self.assertEqual(len(onboarding_pins), 1)
+        self.assertEqual(set(main_pins), set(onboarding_pins))
+
     def test_workflow_requires_opt_in_and_never_performs_bulk_reconciliation(self):
         workflow = WORKFLOW.read_text(encoding="utf-8")
         self.assertIn("AUTO_RULESET_ONBOARDING_ENABLED == 'true'", workflow)