diff --git a/.github/workflows/ci-groom.yml b/.github/workflows/ci-groom.yml
index f478d75..4b3c214 100644
--- a/.github/workflows/ci-groom.yml
+++ b/.github/workflows/ci-groom.yml
@@ -293,7 +293,7 @@ jobs:
     # roster in the PAST tense — a cautionary tale, not current state. Verify
     # against the variable, not the prose, before "fixing" it.) Never hand-bump
     # one of the pair alone.
-    uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@4efe4c559b37339a22ae3547aa108f95d1ea4aca # main @ 4efe4c5
+    uses: Comfy-Org/github-workflows/.github/workflows/groom.yml@23c7b69392d08e57f545d393faa391e43cf4dd55 # main @ 23c7b69
     with:
       # File groom's issues AND open its builder PRs as cloud-code-bot (App
       # token), not github-actions[bot]. With `builder: true` this is no longer
@@ -332,7 +332,7 @@ jobs:
       # Keep the assets ref (finder/verifier briefs + interval gate + dedup
       # ledger) in lock-step with the `uses:` ref above, so a run always loads the
       # scripts that match the workflow filing them. Bump the two together.
-      workflows_ref: 4efe4c559b37339a22ae3547aa108f95d1ea4aca  # main @ 4efe4c5
+      workflows_ref: 23c7b69392d08e57f545d393faa391e43cf4dd55  # main @ 23c7b69
       # Manual dispatch can dry-run; the daily schedule always runs live — for
       # PRs as well as issues, now that the builder is on (github.event.inputs is
       # null on a schedule event -> '' != 'true' -> false).