diff --git a/scripts/checks/extract-installer-pins.mts b/scripts/checks/extract-installer-pins.mts
index 474c0de5d64..fc475603837 100644
--- a/scripts/checks/extract-installer-pins.mts
+++ b/scripts/checks/extract-installer-pins.mts
@@ -645,6 +645,8 @@ const TRUSTED_OPENSHELL_RELEASES: readonly OpenShellReleaseTrust[] = [
       runtimeTemplateSha256: [
         ...V00116_SUPERVISOR_TEMPLATE_BASELINE_SHA256,
         "dceba5ee9bf6d9cd20adf637d63d008c932f751c073bbb0a83cdce087518e917",
+        // Exact 0.1.2 selection with the merged #12928 thread-group process reader.
+        "31e6923609575d64ac36943e58218c801be366b782def8d33406df6e938ef5dd",
       ],
     },
     pinLayout: V00116_OPENSHELL_PIN_LAYOUT,
diff --git a/test/helpers/openshell-installer-template.ts b/test/helpers/openshell-installer-template.ts
index 575a573feb6..7c1619bc658 100644
--- a/test/helpers/openshell-installer-template.ts
+++ b/test/helpers/openshell-installer-template.ts
@@ -176,14 +176,23 @@ export function removeV00106OperationalTrust(source: string): string {
   return `${withoutIdentity.slice(0, capabilityStart)}${withoutIdentity.slice(fallbackStart)}`;
 }
 
-export function prepareReleaseFixtureRuntime(repoRoot: string, root: string): void {
+export function prepareReleaseFixtureRuntime(
+  repoRoot: string,
+  root: string,
+  options: { currentProcessReader?: boolean } = {},
+): void {
   const runtimePath = "src/lib/onboard/docker-driver-gateway-runtime.ts";
   const candidatePins = fs.readFileSync(path.join(root, runtimePath), "utf8");
-  // The 0.1.2 release fixture predates the shared process reader. Keep its
-  // operational runtime bytes on the independently trusted historical template.
-  const source = selectHistoricalGatewayProcessReader(
-    fs.readFileSync(path.join(repoRoot, runtimePath), "utf8"),
-  );
+  const checkoutSource = fs.readFileSync(path.join(repoRoot, runtimePath), "utf8");
+  // By default the 0.1.2 release fixture predates the shared process reader, so keep
+  // its operational runtime bytes on the independently trusted historical template.
+  // currentProcessReader selects the checkout's thread-group reader for 0.1.2 instead.
+  const source = options.currentProcessReader
+    ? checkoutSource.replace(
+        'const QUALIFIED_STABLE_OPENSHELL_VERSION = "0.0.116";',
+        'const QUALIFIED_STABLE_OPENSHELL_VERSION = "0.1.2";',
+      )
+    : selectHistoricalGatewayProcessReader(checkoutSource);
   const prepared = source.replace(
     /const OPENSHELL_SUPERVISOR_MANIFEST_DIGESTS: Readonly<Record<string, string>> = \{[\s\S]*?\n\};/,
     candidatePins.trim(),
diff --git a/test/install/installer-hash-check.test.ts b/test/install/installer-hash-check.test.ts
index e69fd41ab58..fd34b01a2a4 100644
--- a/test/install/installer-hash-check.test.ts
+++ b/test/install/installer-hash-check.test.ts
@@ -1052,6 +1052,14 @@ describe("installer hash verification", () => {
     ]);
   });
 
+  it("admits only the exact thread-group supervisor template with OpenShell 0.1.2", () => {
+    const root = createFixture("0.1.2");
+    prepareReleaseFixtureRuntime(REPO_ROOT, root, { currentProcessReader: true });
+    const run = () => spawnSync("node", preparedReleaseArgs(REPO_ROOT, root), { encoding: "utf8" });
+    expect(run().status).toBe(0);
+    fs.appendFileSync(path.join(root, "src/lib/onboard/docker-driver-gateway-runtime.ts"), "//x");
+    expect(run()).toMatchObject({ status: 1, stderr: expect.stringContaining("not base-trusted") });
+  });
   it.each(V012_TRUST_MUTATIONS)(
     "rejects an altered OpenShell 0.1.2 %s",
     (_label, name, value, diagnostic) => {