diff --git a/.claude/rules/pr-body-contract.md b/.claude/rules/pr-body-contract.md
index 43bffb5..e588518 100644
--- a/.claude/rules/pr-body-contract.md
+++ b/.claude/rules/pr-body-contract.md
@@ -25,6 +25,6 @@ web); the advisory comment and label are noise this rule exists to prevent.
 The canonical machine-readable convention is
 `components/pr-convention-policy/policy.json` in `melodic-software/standards`;
 the SHA-pinned ci-workflows `pr-contract` composite (moved to
-`pr-require-checks/check-contract` at ci-workflows v0.34.0) that runs as a step
+`pr-require-checks/check-contract` at ci-workflows v0.36.0) that runs as a step
 inside `ci-status` is the enforcement authority, and its step output is the
 statement of record.
diff --git a/.github/workflows/pr-automerge-dependabot.yml b/.github/workflows/pr-automerge-dependabot.yml
index 012d592..0d8489e 100644
--- a/.github/workflows/pr-automerge-dependabot.yml
+++ b/.github/workflows/pr-automerge-dependabot.yml
@@ -23,6 +23,6 @@ jobs:
     permissions:
       contents: write # enablePullRequestAutoMerge requires it.
       pull-requests: write # Arm or disarm auto-merge on the PR.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@69e506b7c119517ef1dfc421479232b386b93a52 # v0.35.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
     with:
       runner: ubuntu-24.04
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 424ac73..686ef0f 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -108,7 +108,7 @@ jobs:
       actions: read
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@7446b5165511796b7b0d30b68d341689ebb8de61 # v0.34.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
         with:
           token: ${{ github.token }}
       - name: Aggregate lane results
@@ -116,7 +116,7 @@ jobs:
         # aggregation: the job still fails on the contract step's exit code, and
         # the `ci-lanes` status is on the SHA for the next contract-only run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@7446b5165511796b7b0d30b68d341689ebb8de61 # v0.34.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
         with:
           # At least 60 seconds below this job's `timeout-minutes: 5` (300s), so
           # the fail-closed error is what a contract-only run reports at the