diff --git a/.github/workflows/agentic-ci-authorized-checks.yml b/.github/workflows/agentic-ci-authorized-checks.yml
index 0db32cf6f..b6d8ef651 100644
--- a/.github/workflows/agentic-ci-authorized-checks.yml
+++ b/.github/workflows/agentic-ci-authorized-checks.yml
@@ -79,12 +79,17 @@ jobs:
   DCOAssistant:
     needs: pr
     if: always()
+    permissions:
+      statuses: write
     timeout-minutes: 5
     runs-on: ubuntu-latest
     steps:
       - name: Validate authorization
         env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ inputs.expected_head_sha }}
           PR_RESULT: ${{ needs.pr.result }}
+          REPO: ${{ github.repository }}
           TRUSTED: ${{ needs.pr.outputs.trusted }}
         run: |
           if [ "$PR_RESULT" != "success" ] || [ "$TRUSTED" != "true" ]; then
@@ -93,6 +98,12 @@ jobs:
           fi
           echo "Trusted Agentic CI PR authorized by a maintainer."
 
+          gh api --method POST "repos/${REPO}/statuses/${HEAD_SHA}" \
+            -f state=success \
+            -f context=DCOAssistant \
+            -f description="Trusted Agentic CI PR authorized by a maintainer." \
+            -f target_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
+
   semantic-pull-request:
     name: semantic-pull-request / semantic-pull-request
     needs: pr
diff --git a/.github/workflows/authorize-agentic-ci.yml b/.github/workflows/authorize-agentic-ci.yml
index c61773e27..96772b8ec 100644
--- a/.github/workflows/authorize-agentic-ci.yml
+++ b/.github/workflows/authorize-agentic-ci.yml
@@ -171,6 +171,15 @@ jobs:
             exit 1
           fi
 
+          for WORKFLOW_PATH in .github/workflows/ci.yml .github/workflows/agentic-ci-authorized-checks.yml; do
+            MAIN_WORKFLOW_SHA=$(gh api "repos/${REPO}/contents/${WORKFLOW_PATH}?ref=main" --jq '.sha')
+            HEAD_WORKFLOW_SHA=$(gh api "repos/${REPO}/contents/${WORKFLOW_PATH}?ref=${HEAD_SHA}" --jq '.sha')
+            if [ "$HEAD_WORKFLOW_SHA" != "$MAIN_WORKFLOW_SHA" ]; then
+              comment "Agentic CI checks were not authorized because ${WORKFLOW_PATH} does not match main. Update the PR branch and try again."
+              exit 1
+            fi
+          done
+
           echo "Authorizing checks for ${HEAD_SHA}."
 
       - name: Dispatch checks