diff --git a/.github/workflows/bump-agents-md-callers.yml b/.github/workflows/bump-agents-md-callers.yml
index 03106f3..d3e507f 100644
--- a/.github/workflows/bump-agents-md-callers.yml
+++ b/.github/workflows/bump-agents-md-callers.yml
@@ -56,10 +56,17 @@ concurrency:
 
 jobs:
   bump:
+    # Guard against a workflow_dispatch run from a non-main ref: github.sha is
+    # the tip of whatever ref was selected, and the bumper force-resets a stable
+    # shared branch — a manual run from an older ref would pin every caller to a
+    # stale SHA (and run this job's script, with the App token minted below,
+    # from an unreviewed commit). The push trigger is already main-only, so this
+    # only ever skips stray manual runs.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
@@ -84,4 +91,24 @@ jobs:
           # update flow. Kept in a variable (not the file) so private caller names
           # never land in this public repo or its logs.
           CALLERS_JSON: ${{ vars.AGENTS_MD_CALLERS }}
-        run: bash .github/bump-callers/bump-callers.sh
+        run: |
+          # The main-only ref guard above cannot catch a manual RE-RUN of an
+          # older main run: github.ref is refs/heads/main but github.sha is
+          # that run's original (now stale) commit, and the bumper would
+          # force-repin every caller to it. Only act from the current tip —
+          # any newer push has its own queued run that does the bump.
+          main_tip=$(git ls-remote origin refs/heads/main | cut -f1)
+          if [[ "$main_tip" != "$GITHUB_SHA" ]]; then
+            echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump"
+            exit 0
+          fi
+          # The push path filter also matches a commit that DELETES the
+          # reusable workflow — or the run-time assets callers load from the
+          # pinned SHA (.github/agents-md-integrity/**); bumping callers to a
+          # SHA where either is gone would break every caller. Deletion means
+          # decommissioning — no-op.
+          if [[ ! -f .github/workflows/agents-md-integrity.yml || ! -d .github/agents-md-integrity ]]; then
+            echo "agents-md-integrity.yml or .github/agents-md-integrity/ absent at this SHA — decommissioned; nothing to bump"
+            exit 0
+          fi
+          bash .github/bump-callers/bump-callers.sh
diff --git a/.github/workflows/bump-assign-reviewers-callers.yml b/.github/workflows/bump-assign-reviewers-callers.yml
index 71de7e1..078a2ee 100644
--- a/.github/workflows/bump-assign-reviewers-callers.yml
+++ b/.github/workflows/bump-assign-reviewers-callers.yml
@@ -61,10 +61,17 @@ concurrency:
 
 jobs:
   bump:
+    # Guard against a workflow_dispatch run from a non-main ref: github.sha is
+    # the tip of whatever ref was selected, and the bumper force-resets a stable
+    # shared branch — a manual run from an older ref would pin every caller to a
+    # stale SHA (and run this job's script, with the App token minted below,
+    # from an unreviewed commit). The push trigger is already main-only, so this
+    # only ever skips stray manual runs.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
@@ -89,4 +96,24 @@ jobs:
           # update flow. Kept in a variable (not the file) so private caller names
           # never land in this public repo or its logs.
           CALLERS_JSON: ${{ vars.ASSIGN_REVIEWERS_CALLERS }}
-        run: bash .github/bump-callers/bump-callers.sh
+        run: |
+          # The main-only ref guard above cannot catch a manual RE-RUN of an
+          # older main run: github.ref is refs/heads/main but github.sha is
+          # that run's original (now stale) commit, and the bumper would
+          # force-repin every caller to it. Only act from the current tip —
+          # any newer push has its own queued run that does the bump.
+          main_tip=$(git ls-remote origin refs/heads/main | cut -f1)
+          if [[ "$main_tip" != "$GITHUB_SHA" ]]; then
+            echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump"
+            exit 0
+          fi
+          # The push path filter also matches a commit that DELETES the
+          # reusable workflow; bumping callers to a SHA where the file is gone
+          # would break every caller. Deletion means decommissioning — no-op.
+          # (This fleet has no run-time asset dir — the yml is self-contained —
+          # so unlike the sibling entrypoints only the workflow file is checked.)
+          if [[ ! -f .github/workflows/assign-reviewers.yml ]]; then
+            echo "assign-reviewers.yml absent at this SHA — decommissioned; nothing to bump"
+            exit 0
+          fi
+          bash .github/bump-callers/bump-callers.sh
diff --git a/.github/workflows/bump-cursor-review-callers.yml b/.github/workflows/bump-cursor-review-callers.yml
index 9dbc3e5..36cbb90 100644
--- a/.github/workflows/bump-cursor-review-callers.yml
+++ b/.github/workflows/bump-cursor-review-callers.yml
@@ -68,10 +68,17 @@ concurrency:
 
 jobs:
   bump:
+    # Guard against a workflow_dispatch run from a non-main ref: github.sha is
+    # the tip of whatever ref was selected, and the bumper force-resets a stable
+    # shared branch — a manual run from an older ref would pin every caller to a
+    # stale SHA (and run this job's script, with the App token minted below,
+    # from an unreviewed commit). The push trigger is already main-only, so this
+    # only ever skips stray manual runs.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
@@ -98,4 +105,24 @@ jobs:
           # agents-md-integrity entrypoint never sets this, so bump-callers.sh
           # skips wiring there even if its variable somehow set the flag.
           WIRE_BOT_SCRIPT: ${{ github.workspace }}/.github/cursor-review/wire-bot-identity.py
-        run: bash .github/bump-callers/bump-callers.sh
+        run: |
+          # The main-only ref guard above cannot catch a manual RE-RUN of an
+          # older main run: github.ref is refs/heads/main but github.sha is
+          # that run's original (now stale) commit, and the bumper would
+          # force-repin every caller to it. Only act from the current tip —
+          # any newer push has its own queued run that does the bump.
+          main_tip=$(git ls-remote origin refs/heads/main | cut -f1)
+          if [[ "$main_tip" != "$GITHUB_SHA" ]]; then
+            echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump"
+            exit 0
+          fi
+          # The push path filter also matches a commit that DELETES the
+          # reusable workflow — or the run-time assets callers load from the
+          # pinned SHA (.github/cursor-review/**); bumping callers to a SHA
+          # where either is gone would break every caller. Deletion means
+          # decommissioning — no-op.
+          if [[ ! -f .github/workflows/cursor-review.yml || ! -d .github/cursor-review ]]; then
+            echo "cursor-review.yml or .github/cursor-review/ absent at this SHA — decommissioned; nothing to bump"
+            exit 0
+          fi
+          bash .github/bump-callers/bump-callers.sh
diff --git a/.github/workflows/bump-pr-size-callers.yml b/.github/workflows/bump-pr-size-callers.yml
index 146a775..5e9a272 100644
--- a/.github/workflows/bump-pr-size-callers.yml
+++ b/.github/workflows/bump-pr-size-callers.yml
@@ -60,10 +60,17 @@ concurrency:
 
 jobs:
   bump:
+    # Guard against a workflow_dispatch run from a non-main ref: github.sha is
+    # the tip of whatever ref was selected, and the bumper force-resets a stable
+    # shared branch — a manual run from an older ref would pin every caller to a
+    # stale SHA (and run this job's script, with the App token minted below,
+    # from an unreviewed commit). The push trigger is already main-only, so this
+    # only ever skips stray manual runs.
+    if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
         with:
           persist-credentials: false
 
@@ -88,4 +95,24 @@ jobs:
           # update flow. Kept in a variable (not the file) so private caller names
           # never land in this public repo or its logs.
           CALLERS_JSON: ${{ vars.PR_SIZE_CALLERS }}
-        run: bash .github/bump-callers/bump-callers.sh
+        run: |
+          # The main-only ref guard above cannot catch a manual RE-RUN of an
+          # older main run: github.ref is refs/heads/main but github.sha is
+          # that run's original (now stale) commit, and the bumper would
+          # force-repin every caller to it. Only act from the current tip —
+          # any newer push has its own queued run that does the bump.
+          main_tip=$(git ls-remote origin refs/heads/main | cut -f1)
+          if [[ "$main_tip" != "$GITHUB_SHA" ]]; then
+            echo "github.sha $GITHUB_SHA is not the current main tip ($main_tip) — stale run/re-run; nothing to bump"
+            exit 0
+          fi
+          # The push path filter also matches a commit that DELETES the
+          # reusable workflow — or the run-time tool sources callers build from
+          # the pinned SHA (scripts/check-pr-size/**); bumping callers to a SHA
+          # where either is gone would break every caller. Deletion means
+          # decommissioning — no-op.
+          if [[ ! -f .github/workflows/pr-size.yml || ! -d scripts/check-pr-size ]]; then
+            echo "pr-size.yml or scripts/check-pr-size/ absent at this SHA — decommissioned; nothing to bump"
+            exit 0
+          fi
+          bash .github/bump-callers/bump-callers.sh