diff --git a/.github/CODEX.md b/.github/CODEX.md
index 0af4a7f333161a..d6e0315b17e656 100644
--- a/.github/CODEX.md
+++ b/.github/CODEX.md
@@ -117,6 +117,12 @@ controller or workflow paths. A prerequisite change is deliberately not an
 alter: retire and re-add the topic under a newly reviewed ancestry, or extend
 the policy explicitly.
 
+The three inherited CI workflows may take the exact full-SHA replacements
+listed in `ci_workflow_pins_are_reviewed()`. Those entries allow the reviewed
+action pins without admitting other workflow edits or mode changes. A stable
+topic carries the replacements into both output lanes; changes to the
+approved workflow contents require another controller review.
+
 ## Day-to-day commands
 
 Start a production topic from `master`, or from its intended production
diff --git a/.github/workflows/codex-branch.sh b/.github/workflows/codex-branch.sh
index 1e7d2f28b2fe7b..634828bc7f9215 100755
--- a/.github/workflows/codex-branch.sh
+++ b/.github/workflows/codex-branch.sh
@@ -369,6 +369,27 @@ legacy_control_paths_unchanged () (
 		t/t9905-codex-branch.sh
 )
 
+ci_workflow_pins_are_reviewed () (
+	base_oid=$1
+	head_oid=$2
+
+	# Permit only the reviewed full-SHA replacements of the inherited CI
+	# workflows. Comparing tree entries also rejects mode changes, symlinks,
+	# and deletions. New upstream workflow contents need a new review.
+	while read -r path old_blob new_blob
+	do
+		old=$(git ls-tree "$base_oid" -- "$path") || return 1
+		new=$(git ls-tree "$head_oid" -- "$path") || return 1
+		test "$old" = "$new" && continue
+		test "$old" = "100644 blob $old_blob$tab$path" &&
+		test "$new" = "100644 blob $new_blob$tab$path" || return 1
+	done <<-\EOF
+	.github/workflows/check-style.yml 108a2de903310cfd0f6327353ee700d99d54edc3 b265fe35cbfc51db4cd53729e602de5d36b6632e
+	.github/workflows/check-whitespace.yml ea6f49f742108e27812decc666e6839ab84080f1 3379f89a814abd439ac13efaa572264be5b75080
+	.github/workflows/main.yml 205325eb33b06444f24a11271a9e669841e29cb9 485e3be66581518bca55b62d97ebd2217be194b1
+	EOF
+)
+
 meta_control_paths_unchanged () (
 	base_oid=$1
 	head_oid=$2
@@ -388,7 +409,6 @@ meta_control_paths_unchanged () (
 		.github/workflows/codex-pr-state.yml \
 		.github/workflows/codex-topic.yml \
 		.github/workflows/codex-branch.sh \
-		.github/workflows/main.yml \
 		codex \
 		publish \
 		rebuild \
@@ -400,8 +420,12 @@ meta_control_paths_unchanged () (
 	git diff --quiet "$base_oid" "$head_oid" -- \
 		':(glob).github/workflows/*.yml' \
 		':(glob).github/workflows/*.yaml' \
+		':(exclude).github/workflows/check-style.yml' \
+		':(exclude).github/workflows/check-whitespace.yml' \
+		':(exclude).github/workflows/main.yml' \
 		':(exclude).github/workflows/codex.yml' \
-		':(exclude).github/workflows/codex-release.yml'
+		':(exclude).github/workflows/codex-release.yml' &&
+	ci_workflow_pins_are_reviewed "$base_oid" "$head_oid"
 )
 
 write_automation_workflow () {
@@ -8204,7 +8228,6 @@ topic_control_paths_unchanged () (
 		.github/workflows/codex-topic.yml \
 		.github/workflows/codex.yml \
 		.github/workflows/codex-branch.sh \
-		.github/workflows/main.yml \
 		codex \
 		publish \
 		rebuild \
@@ -8216,7 +8239,11 @@ topic_control_paths_unchanged () (
 	git diff --quiet "$base_oid" "$head_oid" -- \
 		':(glob).github/workflows/*.yml' \
 		':(glob).github/workflows/*.yaml' \
-		':(exclude).github/workflows/codex-release.yml'
+		':(exclude).github/workflows/check-style.yml' \
+		':(exclude).github/workflows/check-whitespace.yml' \
+		':(exclude).github/workflows/main.yml' \
+		':(exclude).github/workflows/codex-release.yml' &&
+	ci_workflow_pins_are_reviewed "$base_oid" "$head_oid"
 )
 
 verify_unstable_control_paths () (