diff --git a/config/template-drift-allowlist.txt b/config/template-drift-allowlist.txt
index ce269e80e..fc7543813 100644
--- a/config/template-drift-allowlist.txt
+++ b/config/template-drift-allowlist.txt
@@ -87,8 +87,8 @@ reason = Intentional divergence (re-baselined 2026-06-14): consumer template SHA
 main = .github/workflows/agents-guard.yml
 template = templates/consumer-repo/.github/workflows/agents-guard.yml
 main_sha256 = 0f8534a819ab769499c129ae5473d6785d8fa9c01d52efab7613b168ec6ce1f2
-template_sha256 = 884a01f83307a66993233ad9208502114d3a6b0ed0c05b27e0d23b96e5899db4
-reason = Intentional divergence re-baselined 2026-06-23: root and consumer guard workflows differ for pinned consumer actions/App-token setup; root and consumer setup-api-client pins were refreshed to the current Workflows main digest 6c3391d.
+template_sha256 = 52247fc561df900e13122f4cb51b9949341e397c5d0ce2d4aea75d57e8273daf
+reason = Intentional divergence re-baselined 2026-06-26: root and consumer guard workflows differ for pinned consumer actions/App-token setup; consumer setup-api-client pins were refreshed to the Workflows a525e6e digest.
 
 [pair.11]
 main = .github/workflows/agents-issue-optimizer.yml
diff --git a/templates/consumer-repo/.github/workflows/agents-guard.yml b/templates/consumer-repo/.github/workflows/agents-guard.yml
index 35ef48c9a..4d465af18 100644
--- a/templates/consumer-repo/.github/workflows/agents-guard.yml
+++ b/templates/consumer-repo/.github/workflows/agents-guard.yml
@@ -111,7 +111,7 @@ jobs:
           github.event_name == 'pull_request_target' &&
           steps.eligibility.outputs.should-run == 'true' &&
           steps.api_client_base.outputs.available != 'true'
-        uses: "stranske/Workflows/.github/actions/setup-api-client@6c3391d38bbc20a4577ac42b9aa6c9dc4e462c09" # v1
+        uses: "stranske/Workflows/.github/actions/setup-api-client@a525e6e3e2431d302073de65723c6e022f4b02fa" # v1
         with:
           secrets: ${{ toJSON(secrets) }}
           github_token: ${{ github.token }}
@@ -180,7 +180,7 @@ jobs:
           steps.eligibility.outputs.should-run == 'true' &&
           github.event_name == 'pull_request' &&
           steps.api_client_head.outputs.available != 'true'
-        uses: "stranske/Workflows/.github/actions/setup-api-client@6c3391d38bbc20a4577ac42b9aa6c9dc4e462c09" # v1
+        uses: "stranske/Workflows/.github/actions/setup-api-client@a525e6e3e2431d302073de65723c6e022f4b02fa" # v1
         with:
           secrets: ${{ toJSON(secrets) }}
           github_token: ${{ github.token }}