diff --git a/test/trusted-workflow-source-rollforward.test.ts b/test/trusted-workflow-source-rollforward.test.ts
index 23a10157b..6e8277dbf 100644
--- a/test/trusted-workflow-source-rollforward.test.ts
+++ b/test/trusted-workflow-source-rollforward.test.ts
@@ -2,7 +2,7 @@ import { readFileSync } from "node:fs";
 import { describe, expect, it } from "vitest";
 
 const auditedCentralWorkflowSourceSha =
-  "23a776ed37027d8ab8ab2aefcf81fac586352e2f";
+  "885f2cd251999f21cf562cab3e2d9cc3cc3ec737";
 
 describe("trusted central workflow source revision", () => {
   it("binds the deployed OIDC trust configuration to the audited central source commit", () => {
diff --git a/wrangler.toml b/wrangler.toml
index 7ba187383..4b8c3affb 100644
--- a/wrangler.toml
+++ b/wrangler.toml
@@ -24,7 +24,7 @@ ALLOWED_AUDIENCE = "cwl-noema-review"
 ALLOWED_REPOSITORY_OWNER = "ContextualWisdomLab"
 ALLOWED_WORKFLOW_REPOSITORY = "ContextualWisdomLab/.github"
 ALLOWED_WORKFLOW_REF_PREFIX = "ContextualWisdomLab/.github/.github/workflows/noema-review.yml@refs/heads/main"
-ALLOWED_WORKFLOW_SHA = "23a776ed37027d8ab8ab2aefcf81fac586352e2f"
+ALLOWED_WORKFLOW_SHA = "885f2cd251999f21cf562cab3e2d9cc3cc3ec737"
 GITHUB_API_BASE = "https://api.github.com"
 GITHUB_APP_SLUG = "noema"
 NOEMA_RATE_LIMIT_PER_MINUTE = "60"