diff --git a/.github/workflows/agent.yml b/.github/workflows/agent.yml
index a1964f0..0e2db73 100644
--- a/.github/workflows/agent.yml
+++ b/.github/workflows/agent.yml
@@ -40,7 +40,7 @@ concurrency:
 
 jobs:
   agent:
-    uses: YiAgent/OpenCI/.github/workflows/reusable-agent.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-agent.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       task: ${{ inputs.task }}
       prompt: ${{ inputs.prompt }}
diff --git a/.github/workflows/ci-self-test.yml b/.github/workflows/ci-self-test.yml
index 89c1d56..cf217cd 100644
--- a/.github/workflows/ci-self-test.yml
+++ b/.github/workflows/ci-self-test.yml
@@ -42,7 +42,7 @@ concurrency:
 
 jobs:
   self-test:
-    uses: YiAgent/OpenCI/.github/workflows/reusable-self-test.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-self-test.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       runner: ubuntu-latest
     secrets: inherit
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8d7385f..23b2934 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   ci:
-    uses: YiAgent/OpenCI/.github/workflows/reusable-ci.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-ci.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       openci-ref:      ${{ github.sha }}
       registry:        ghcr.io
diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 0283c15..28d5ca7 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -15,6 +15,6 @@ concurrency:
 
 jobs:
   deps:
-    uses: YiAgent/OpenCI/.github/workflows/reusable-deps.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-deps.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       runner: blacksmith-2vcpu-ubuntu-2404
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 54786bf..63ed5f2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -34,7 +34,7 @@ jobs:
         && github.event.workflow_run.name == 'ci'
         && github.event.workflow_run.conclusion == 'success')
       || (github.event_name == 'workflow_dispatch' && inputs.mode == 'stg')
-    uses: YiAgent/OpenCI/.github/workflows/reusable-stg.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-stg.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       app-name:            ${{ vars.APP_NAME || github.event.repository.name }}
       image-name:          ${{ vars.IMAGE_NAME || github.event.repository.name }}
@@ -55,7 +55,7 @@ jobs:
         && github.event.workflow_run.name == 'release'
         && github.event.workflow_run.conclusion == 'success')
       || (github.event_name == 'workflow_dispatch' && inputs.mode == 'prd')
-    uses: YiAgent/OpenCI/.github/workflows/reusable-prd.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-prd.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       app-name:            ${{ vars.APP_NAME || github.event.repository.name }}
       image-name:          ${{ vars.IMAGE_NAME || github.event.repository.name }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index a97ca6e..1bc9ec3 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -27,7 +27,7 @@ concurrency:
 
 jobs:
   docs:
-    uses: YiAgent/OpenCI/.github/workflows/reusable-docs.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-docs.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       build-cmd:    ${{ vars.DOCS_BUILD_CMD || '' }}
       docs-path:    ${{ vars.DOCS_DIR || 'docs' }}
diff --git a/.github/workflows/issue-ops.yml b/.github/workflows/issue-ops.yml
index 07afe44..ed6a23d 100644
--- a/.github/workflows/issue-ops.yml
+++ b/.github/workflows/issue-ops.yml
@@ -37,7 +37,7 @@ concurrency:
 jobs:
   lifecycle:
     if: github.event_name == 'issues' || github.event_name == 'issue_comment'
-    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode: lifecycle
       runner: blacksmith-2vcpu-ubuntu-2404
@@ -52,7 +52,7 @@ jobs:
 
   ingest:
     if: github.event_name == 'repository_dispatch'
-    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode: ingest
       runner: blacksmith-2vcpu-ubuntu-2404
@@ -67,7 +67,7 @@ jobs:
 
   maintenance:
     if: github.event_name == 'schedule' || (github.event_name == 'workflow_dispatch' && inputs.mode == 'maintenance')
-    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode: maintenance
       runner: blacksmith-2vcpu-ubuntu-2404
@@ -82,7 +82,7 @@ jobs:
 
   manual:
     if: github.event_name == 'workflow_dispatch' && inputs.mode != 'maintenance'
-    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-issue.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode: ${{ inputs.mode }}
       runner: blacksmith-2vcpu-ubuntu-2404
diff --git a/.github/workflows/observability.yml b/.github/workflows/observability.yml
index 81e9fb4..3985c2f 100644
--- a/.github/workflows/observability.yml
+++ b/.github/workflows/observability.yml
@@ -33,7 +33,7 @@ concurrency:
 jobs:
   observe-canary:
     if: ${{ github.event_name == 'schedule' && github.event.schedule == '*/15 * * * *' }}
-    uses: YiAgent/OpenCI/.github/workflows/reusable-observability.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-observability.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode:   canary-watch
       runner: blacksmith-2vcpu-ubuntu-2404
@@ -41,7 +41,7 @@ jobs:
 
   observe-drift:
     if: ${{ github.event_name == 'schedule' && github.event.schedule == '0 4 * * *' }}
-    uses: YiAgent/OpenCI/.github/workflows/reusable-observability.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-observability.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode:      terraform-drift
       infra-dir: ${{ vars.INFRA_DIR || 'infrastructure' }}
@@ -53,7 +53,7 @@ jobs:
       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
       || github.event_name == 'repository_dispatch'
       || (github.event_name == 'workflow_dispatch' && inputs.mode == 'verify-fix')
-    uses: YiAgent/OpenCI/.github/workflows/reusable-observability.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-observability.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode:   verify-fix
       runner: blacksmith-2vcpu-ubuntu-2404
diff --git a/.github/workflows/on-maintenance.yml b/.github/workflows/on-maintenance.yml
index 7dc8622..ba9850a 100644
--- a/.github/workflows/on-maintenance.yml
+++ b/.github/workflows/on-maintenance.yml
@@ -116,7 +116,7 @@ jobs:
     if: |
       !contains(fromJSON('["pr-review","flag-audit"]'),
         needs.resolve-mode.outputs.mode)
-    uses: YiAgent/OpenCI/.github/workflows/reusable-maintenance.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-maintenance.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode:       ${{ needs.resolve-mode.outputs.mode }}
       openci-ref: ${{ needs.resolve-mode.outputs.openci-ref }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 3062dcd..6452dc9 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -28,7 +28,7 @@ concurrency:
 
 jobs:
   checks:
-    uses: YiAgent/OpenCI/.github/workflows/reusable-pr.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-pr.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       enable-ai-review: true
       enable-eval:      true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9cc7aa2..d12d8b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ concurrency:
 
 jobs:
   release:
-    uses: YiAgent/OpenCI/.github/workflows/reusable-release.yml@50ce4563fbe54e021002ea258bdae24cb5581316
+    uses: YiAgent/OpenCI/.github/workflows/reusable-release.yml@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
     with:
       mode: ${{ inputs.mode || 'both' }}
       image-name: ${{ vars.IMAGE_NAME || github.event.repository.name }}
diff --git a/.github/workflows/reusable-ci.yml b/.github/workflows/reusable-ci.yml
index 4d65984..0947c7c 100644
--- a/.github/workflows/reusable-ci.yml
+++ b/.github/workflows/reusable-ci.yml
@@ -127,7 +127,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - name: Probe secrets
@@ -155,7 +155,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - id: detect
@@ -183,7 +183,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - id: build
@@ -212,7 +212,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - id: scan
@@ -235,7 +235,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772  # v3.4.0
@@ -282,7 +282,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - uses: ./.openci/actions/ci/check-migration
@@ -305,7 +305,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - uses: ./.openci/actions/ci/eval-smoke
@@ -485,7 +485,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
         with: { persist-credentials: false }
       - name: Resolve OpenCI ref and checkout
-        uses: YiAgent/OpenCI/actions/_common/resolve-openci@50ce4563fbe54e021002ea258bdae24cb5581316
+        uses: YiAgent/OpenCI/actions/_common/resolve-openci@25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c
         with:
           openci-ref: ${{ inputs.openci-ref }}
       - name: Download ci-context artifact
diff --git a/manifest.yml b/manifest.yml
index 9b84fe4..d7ba244 100644
--- a/manifest.yml
+++ b/manifest.yml
@@ -101,7 +101,7 @@ deps:
   softprops/action-gh-release:            "b4309332981a82ec1c5618f44dd2e27cc8bfbfda"  # v3.0.0
 
   # ── Self (OpenCI vendoring itself via remote action reference) ──────────
-  YiAgent/OpenCI:                         "50ce4563fbe54e021002ea258bdae24cb5581316"  # resolve-openci bootstrap
+  YiAgent/OpenCI:                         "25e3f66f1fed78bcc7b4a31b72caf16e195f4f9c"  # resolve-openci bootstrap
 
 # ─────────────────────────────────────────────────────────────────────────────
 # Reusable workflow catalog (consumed via `uses: YiAgent/OpenCI/.github/workflows/<id>.yml@<ref>`)