diff --git a/.github/scripts/tests/agent-ingress-workflow.bats b/.github/scripts/tests/agent-ingress-workflow.bats
index 6e32d78d..9667ef32 100644
--- a/.github/scripts/tests/agent-ingress-workflow.bats
+++ b/.github/scripts/tests/agent-ingress-workflow.bats
@@ -92,10 +92,10 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst)
   [[ "$output" == *"/pr-auto-review-reusable.yml@pr-auto-review/v1-stable" ]]
   run yq '.jobs.pr-review.uses' "$WORKFLOW"
   [ "$status" -eq 0 ]
-  [[ "$output" == *"/pr-review.yml@pr-review/stable" ]]
+  [[ "$output" == *"/pr-review.yml@pr-review/v1-stable" ]]
   run yq '.jobs.pr-review.with.agent_ref' "$WORKFLOW"
   [ "$status" -eq 0 ]
-  [ "$output" = "pr-review/stable" ]
+  [ "$output" = "pr-review/v1-stable" ]
   run yq '.jobs.pr-review-mention.uses' "$WORKFLOW"
   [ "$status" -eq 0 ]
   [[ "$output" == *"/pr-review-mention-reusable.yml@pr-review-mention/v2-stable" ]]
@@ -161,3 +161,10 @@ ROLES=(dev-lead pr-auto-review pr-review pr-review-mention ci-failure-analyst)
       || { printf '%s\n' "$role: if: reaches repo state"; return 1; }
   done
 }
+
+@test "pr-review pins the major-scoped v1-stable channel, not the legacy bare tag (#520)" {
+  run grep -E '/pr-review\.yml@' "$WORKFLOW"
+  [ "$status" -eq 0 ]
+  [[ "$output" =~ @pr-review/v1-stable[[:space:]]+#[[:space:]]*NOSONAR\(githubactions:S7637\)[[:space:]]+first-party[[:space:]]+channel[[:space:]]+ref ]]
+  [[ "$output" != *"DEFECTIVE PIN"* ]]
+}
diff --git a/.github/workflows/agent-ingress.yml b/.github/workflows/agent-ingress.yml
index 5cdac1ad..d411cff0 100644
--- a/.github/workflows/agent-ingress.yml
+++ b/.github/workflows/agent-ingress.yml
@@ -142,9 +142,9 @@ jobs:
       contents: read
       pull-requests: write
       checks: read
-    uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/stable  # NOSONAR(githubactions:S7637) first-party channel ref  # DEFECTIVE PIN — see §5
+    uses: petry-projects/.github-private/.github/workflows/pr-review.yml@pr-review/v1-stable  # NOSONAR(githubactions:S7637) first-party channel ref
     with:
-      agent_ref: pr-review/stable
+      agent_ref: pr-review/v1-stable
       pr_url: ${{ inputs.pr_url || '' }}
       dry_run: ${{ inputs.dry_run || '' }}
       force_review: ${{ inputs.force_review || '' }}