diff --git a/.github/workflows/pr-check-managed-files-hosted.yml b/.github/workflows/pr-check-managed-files-hosted.yml
index aaa2308..2322da0 100644
--- a/.github/workflows/pr-check-managed-files-hosted.yml
+++ b/.github/workflows/pr-check-managed-files-hosted.yml
@@ -113,7 +113,7 @@ jobs:
       - name: Guard managed files
         # The org requires actions pinned to a full commit SHA (reusable
         # workflows may float on main); this pin moves by hand.
-        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@2476d5dde8979eab34374150b7e4b0a2b99f4e88 # 2476d5d 2026-10-29
+        uses: melodic-software/ci-workflows/.github/actions/check-managed-files@0691df79a6c0de7f1e49df618ac7b321605563f9 # v0.68.0
         with:
           # `main` for the soak, per the action's own input contract ("Pin to
           # a full SHA in callers once soak completes"): the guard must read