diff --git a/.github/scripts/local-runner-canary.test.cjs b/.github/scripts/local-runner-canary.test.cjs
index 1d49892..a305627 100644
--- a/.github/scripts/local-runner-canary.test.cjs
+++ b/.github/scripts/local-runner-canary.test.cjs
@@ -56,7 +56,7 @@ const supersededSelectorShas = [
   "257f584ea24f65824acd17a8d9bbfbe650d24033",
   "66e3e974e9c0132150cc982cdd76aca284df19de",
 ];
-const currentCanarySha = "169e3a4287211a536eddcd3a757dd06132fb556e";
+const currentCanarySha = "c18c3d73b996081729d1955b256d9f7d31626b0f";
 const supersededCanaryShas = [
   "bb762391c41e9d12975fae25a06ac930050baba9",
   "2dfd2c97ea12e027d5b1067f35a7a391673b45a2",
diff --git a/.github/scripts/production-ha-proof.test.cjs b/.github/scripts/production-ha-proof.test.cjs
index 33273d1..5d2fc5c 100644
--- a/.github/scripts/production-ha-proof.test.cjs
+++ b/.github/scripts/production-ha-proof.test.cjs
@@ -42,7 +42,7 @@ const templateReadme = fs.readFileSync(
   path.join(templateRoot, "README.md"),
   "utf8",
 );
-const implementationSha = "169e3a4287211a536eddcd3a757dd06132fb556e";
+const implementationSha = "c18c3d73b996081729d1955b256d9f7d31626b0f";
 
 function jobBlock(jobId) {
   const start = workflow.indexOf(`  ${jobId}:\n`);
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa90c56..7b079e9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -345,12 +345,6 @@ jobs:
         with:
           node-version: 24.18.0
           package-manager-cache: false
-      - name: Fetch immutable workflow pins under test
-        # A full-history checkout excludes hidden PR refs after their source
-        # branches are deleted, so acquire only the exact commits under test.
-        run: |
-          git fetch --no-tags --no-write-fetch-head --depth=1 origin \
-            169e3a4287211a536eddcd3a757dd06132fb556e
       - name: Test selector and generated workflow contracts
         run: node --test .github/scripts/*.test.cjs
       - name: Test OSV scan policy guard
diff --git a/.github/workflows/selector-conformance.yml b/.github/workflows/selector-conformance.yml
index 03ec192..ee60174 100644
--- a/.github/workflows/selector-conformance.yml
+++ b/.github/workflows/selector-conformance.yml
@@ -70,12 +70,6 @@ jobs:
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 24.18.0
-      - name: Fetch immutable workflow pins under test
-        # A full-history checkout excludes hidden PR refs after their source
-        # branches are deleted, so acquire only the exact commits under test.
-        run: |
-          git fetch --no-tags --no-write-fetch-head --depth=1 origin \
-            169e3a4287211a536eddcd3a757dd06132fb556e
       - name: Test selector implementation, generation, and immutable pins
         run: node --test .github/scripts/*.test.cjs
       - name: Test OSV scanner exit-code policy
diff --git a/templates/ci-runner-canary/.github/workflows/local-runner-canary.yml b/templates/ci-runner-canary/.github/workflows/local-runner-canary.yml
index 6c44357..e76733b 100644
--- a/templates/ci-runner-canary/.github/workflows/local-runner-canary.yml
+++ b/templates/ci-runner-canary/.github/workflows/local-runner-canary.yml
@@ -20,7 +20,7 @@ jobs:
     name: Local runner canary
     permissions:
       contents: read
-    uses: melodic-software/ci-workflows/.github/workflows/local-runner-canary.yml@169e3a4287211a536eddcd3a757dd06132fb556e # reviewed canary contract
+    uses: melodic-software/ci-workflows/.github/workflows/local-runner-canary.yml@c18c3d73b996081729d1955b256d9f7d31626b0f # reviewed canary contract
     with:
       mode: ${{ inputs.mode }}
       cache-epoch: ${{ vars.CI_CACHE_EPOCH }}
diff --git a/templates/ci-runner-canary/.github/workflows/production-ha-proof.yml b/templates/ci-runner-canary/.github/workflows/production-ha-proof.yml
index 3afe273..f31df84 100644
--- a/templates/ci-runner-canary/.github/workflows/production-ha-proof.yml
+++ b/templates/ci-runner-canary/.github/workflows/production-ha-proof.yml
@@ -29,7 +29,7 @@ jobs:
   proof:
     name: Production HA proof
     permissions: {}
-    uses: melodic-software/ci-workflows/.github/workflows/production-ha-proof.yml@169e3a4287211a536eddcd3a757dd06132fb556e # reviewed production HA contract
+    uses: melodic-software/ci-workflows/.github/workflows/production-ha-proof.yml@c18c3d73b996081729d1955b256d9f7d31626b0f # reviewed production HA contract
     with:
       mode: ${{ inputs.mode }}
       observer-client-id: ${{ vars.CI_RUNNER_OBSERVER_CLIENT_ID }}