diff --git a/renovate.json b/renovate.json
index e09f2f8b..dc65586d 100644
--- a/renovate.json
+++ b/renovate.json
@@ -15,6 +15,20 @@
         "ruff_text_size"
       ],
       "groupName": "Ruff components"
+    },
+    {
+      "matchManagers": [
+        "cargo"
+      ],
+      "matchFileNames": [
+        "tools/extension-qualification/Cargo.toml"
+      ],
+      "matchPackageNames": [
+        "morphir-extension-sdk",
+        "morphir-host",
+        "morphir-host-native"
+      ],
+      "groupName": "qualification host source"
     }
   ]
 }
diff --git a/tests/unit/test_qualification_host_source.py b/tests/unit/test_qualification_host_source.py
new file mode 100644
index 00000000..51ff8149
--- /dev/null
+++ b/tests/unit/test_qualification_host_source.py
@@ -0,0 +1,24 @@
+"""Qualification receipts must identify the host source actually built."""
+
+from __future__ import annotations
+
+import re
+import tomllib
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def test_qualification_receipt_matches_one_host_dependency_revision() -> None:
+    """Prevent mixed host types and falsely attributed qualification reports."""
+    tool = ROOT / "tools" / "extension-qualification"
+    dependencies = tomllib.loads((tool / "Cargo.toml").read_text())["dependencies"]
+    names = ("morphir-extension-sdk", "morphir-host", "morphir-host-native")
+    sources = {(dependencies[name]["git"], dependencies[name]["rev"]) for name in names}
+    assert len(sources) == 1, "Qualification host dependencies must share one source"
+    _, revision = sources.pop()
+    assert re.fullmatch(r"[0-9a-f]{40}", revision)
+    source = (tool / "src" / "main.rs").read_text()
+    declared = re.search(r'const HOST_SOURCE: &str = "([0-9a-f]{40})";', source)
+    assert declared is not None
+    assert declared.group(1) == revision, "Receipt source must match built dependencies"
diff --git a/tools/extension-qualification/Cargo.lock b/tools/extension-qualification/Cargo.lock
index cf2901cd..f2595aef 100644
--- a/tools/extension-qualification/Cargo.lock
+++ b/tools/extension-qualification/Cargo.lock
@@ -2172,7 +2172,7 @@ dependencies = [
 [[package]]
 name = "morphir-common"
 version = "0.2.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "anyhow",
  "cap-fs-ext 4.0.3",
@@ -2213,7 +2213,7 @@ dependencies = [
 [[package]]
 name = "morphir-config"
 version = "0.0.1"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "secrecy",
  "serde",
@@ -2226,7 +2226,7 @@ dependencies = [
 [[package]]
 name = "morphir-core"
 version = "0.2.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "anyhow",
  "bigdecimal",
@@ -2246,7 +2246,7 @@ dependencies = [
 [[package]]
 name = "morphir-distribution"
 version = "0.2.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "flate2",
  "fs2",
@@ -2270,7 +2270,7 @@ dependencies = [
 [[package]]
 name = "morphir-extension-sdk"
 version = "0.4.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "base64 0.22.1",
  "extism-pdk",
@@ -2289,7 +2289,7 @@ dependencies = [
 [[package]]
 name = "morphir-host"
 version = "0.2.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "async-lock",
  "async-trait",
@@ -2305,7 +2305,7 @@ dependencies = [
 [[package]]
 name = "morphir-host-native"
 version = "0.2.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "async-trait",
  "base64 0.23.1",
@@ -2329,7 +2329,7 @@ dependencies = [
 [[package]]
 name = "morphir-json"
 version = "0.2.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "serde",
  "serde_json",
@@ -2355,7 +2355,7 @@ dependencies = [
 [[package]]
 name = "morphir-workspace"
 version = "0.2.0"
-source = "git+https://github.com/finos/morphir-rust.git?rev=d51daa8aea7ae09ae295ff254d72b27770c64104#d51daa8aea7ae09ae295ff254d72b27770c64104"
+source = "git+https://github.com/finos/morphir-rust.git?rev=945486e1320385e22986ef937db82e344b179d05#945486e1320385e22986ef937db82e344b179d05"
 dependencies = [
  "globset",
  "morphir-config",
diff --git a/tools/extension-qualification/Cargo.toml b/tools/extension-qualification/Cargo.toml
index 3bf0b3bb..c537c958 100644
--- a/tools/extension-qualification/Cargo.toml
+++ b/tools/extension-qualification/Cargo.toml
@@ -13,9 +13,9 @@ publish = false
 anyhow = "1"
 async-trait = "0.1"
 hex = "0.4"
-morphir-extension-sdk = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" }
-morphir-host = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" }
-morphir-host-native = { git = "https://github.com/finos/morphir-rust.git", rev = "d51daa8aea7ae09ae295ff254d72b27770c64104" }
+morphir-extension-sdk = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" }
+morphir-host = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" }
+morphir-host-native = { git = "https://github.com/finos/morphir-rust.git", rev = "945486e1320385e22986ef937db82e344b179d05" }
 serde_json = { version = "1", features = ["arbitrary_precision"] }
 serde = { version = "1", features = ["derive"] }
 sha2 = "0.11"
diff --git a/tools/extension-qualification/README.md b/tools/extension-qualification/README.md
index 14eacd00..e7224b7f 100644
--- a/tools/extension-qualification/README.md
+++ b/tools/extension-qualification/README.md
@@ -2,7 +2,7 @@
 
 This developer-only executable exercises the actual WASM and native process
 guest bytes through `morphir-host` and `morphir-host-native` at
-`d51daa8aea7ae09ae295ff254d72b27770c64104`. It uses the upstream Extism and
+`945486e1320385e22986ef937db82e344b179d05`. It uses the upstream Extism and
 process channels directly. Process launches have an empty environment and do
 not use Python or a Rust launcher.
 
diff --git a/tools/extension-qualification/src/main.rs b/tools/extension-qualification/src/main.rs
index 535097d9..08c43604 100644
--- a/tools/extension-qualification/src/main.rs
+++ b/tools/extension-qualification/src/main.rs
@@ -26,7 +26,7 @@ use std::{
 };
 use tokio::sync::Mutex;
 
-const HOST_SOURCE: &str = "d51daa8aea7ae09ae295ff254d72b27770c64104";
+const HOST_SOURCE: &str = "945486e1320385e22986ef937db82e344b179d05";
 const ID: &str = "morphir-python";
 const TYPES_SOURCE: &str =
     "from dataclasses import dataclass\n@dataclass(frozen=True)\nclass Box:\n    value: int\n";