diff --git a/apps/docs/content/docs/workflows/deployment/api.mdx b/apps/docs/content/docs/workflows/deployment/api.mdx
index 412b1e76c63..481ac6a47af 100644
--- a/apps/docs/content/docs/workflows/deployment/api.mdx
+++ b/apps/docs/content/docs/workflows/deployment/api.mdx
@@ -14,6 +14,17 @@ You need workspace **Admin** access and the applicable deployment permission. Te
 
 Ordinary API calls use the active snapshot. Editing the draft does not change that version. Deploy an update before expecting a normal API call to use your changes.
 
+### Run an earlier version [#run-a-version]
+
+To run a specific deployment version instead of the active one, name its number in `run.version`. The workflow must still be deployed, and the caller needs workspace **Write** access with an API key or OAuth access token; anonymous public-API callers cannot pin a version. An unknown version returns `404`. The run's status reports the version it ran in `version`.
+
+```bash
+curl -X POST 'https://www.sim.ai/api/v2/workflows/{workflow-id}/execute' \
+  -H "X-API-Key: $SIM_API_KEY" \
+  -H 'Content-Type: application/json' \
+  -d '{"input":{"message":"Summarize this article"},"run":{"source":"deployment","version":3}}'
+```
+
 ## Authentication
 
 Send a valid Sim API key in `X-API-Key`, or use a supported OAuth access token. Deployed workflow execution requires access to the workflow's workspace; OAuth callers also need the operation's `api:write` scope. See [API authentication](/api-reference/authentication).
@@ -249,6 +260,8 @@ A completed response includes the result when requested:
 
 Stop polling on `completed`, `failed`, or `cancelled`. A paused Human run requires submitted input; a time pause can resume automatically. See [Human](/workflows/blocks/human-in-the-loop) and [Wait](/workflows/blocks/wait). Resuming an originally streaming run through the v2 resume endpoint returns an async receipt, not an SSE continuation.
 
+A paused run lists every point it waits at in `paused.points`: the block, whether it is a `human` or `time` pause, its resume state, any parallel branch or loop iteration, its place in the resume queue, and the `inputFields` a Human pause asks for. With `includeOutput=true`, each point also carries the reviewer `display` content with resolved secrets redacted; organization permission groups that hide execution data withhold it, along with `inputFields`, whose labels and descriptions are resolved from run data. Resume a point by sending its `contextId` to `POST /api/v2/workflows/{workflow-id}/runs/{runId}/resume`.
+
 ## Select outputs and handle large values [#oversized-outputs]
 
 `selectedOutputs` can project smaller fields. For a synchronous v2 call, selected values appear in `data.blockOutputs`, separately from `data.output`.
diff --git a/apps/docs/openapi-v2-workflows.json b/apps/docs/openapi-v2-workflows.json
index 58a725eeae1..8d7fc7cb356 100644
--- a/apps/docs/openapi-v2-workflows.json
+++ b/apps/docs/openapi-v2-workflows.json
@@ -3958,7 +3958,7 @@
       "post": {
         "operationId": "executeWorkflowV2",
         "summary": "Execute workflow",
-        "description": "Run the active deployment, or set `run.source: \"manual\"` to run the saved draft. Deployed execution requires workspace read access and OAuth `api:write` scope or an API key; public deployments also allow anonymous synchronous or streamed runs. Manual runs require personal-key or OAuth write access and cannot be async.\n\nUse `async: true` for a queue receipt, or `stream: true` for SSE. For a synchronous run with both flags false, send `Accept: application/x-ndjson` for heartbeat frames and a final frame containing `data`. With `waitTimeoutSeconds`, a synchronous run still going when the wait elapses continues in the background and answers with its run receipt instead: `202` on a JSON response, or a closing `detached` frame on an NDJSON stream, which keeps its `200`. Timeouts return `200` with `status: \"failed\"` and `error.code: \"TIMEOUT\"`; inspect run status. See [Streaming](/workflows/deployment/api#streaming) for event formats. Input descriptions specify compatible modes; invalid combinations return `400`.\n\nSupply `X-Run-Id` to prevent duplicate execution. Reuse returns `409`, without replaying results. A `503` with `error.details.code: \"ASYNC_ENQUEUE_AMBIGUOUS\"` omits `Retry-After` because the run may already have started. Reconcile using the returned run ID; do not start another run with a new or omitted ID.\n\nOAuth scope: `api:write`.",
+        "description": "Run the active deployment, set `run: { source: \"deployment\", version }` to run an earlier deployment version, or set `run.source: \"manual\"` to run the saved draft. Deployed execution requires workspace read access and OAuth `api:write` scope or an API key; public deployments also allow anonymous synchronous or streamed runs. Running a chosen version requires workspace write access and an API key or OAuth access token; an unknown version returns `404`. Manual runs require personal-key or OAuth write access and cannot be async.\n\nUse `async: true` for a queue receipt, or `stream: true` for SSE. For a synchronous run with both flags false, send `Accept: application/x-ndjson` for heartbeat frames and a final frame containing `data`. With `waitTimeoutSeconds`, a synchronous run still going when the wait elapses continues in the background and answers with its run receipt instead: `202` on a JSON response, or a closing `detached` frame on an NDJSON stream, which keeps its `200`. Timeouts return `200` with `status: \"failed\"` and `error.code: \"TIMEOUT\"`; inspect run status. See [Streaming](/workflows/deployment/api#streaming) for event formats. Input descriptions specify compatible modes; invalid combinations return `400`.\n\nSupply `X-Run-Id` to prevent duplicate execution. Reuse returns `409`, without replaying results. A `503` with `error.details.code: \"ASYNC_ENQUEUE_AMBIGUOUS\"` omits `Retry-After` because the run may already have started. Reconcile using the returned run ID; do not start another run with a new or omitted ID.\n\nOAuth scope: `api:write`.",
         "x-sim-operation": "workflows.execute",
         "x-oauth-scope": "api:write",
         "tags": ["Workflows"],
@@ -4405,7 +4405,7 @@
       "get": {
         "operationId": "getWorkflowRunV2",
         "summary": "Get workflow run",
-        "description": "Read current run state with workspace read access. Request final output and files with `includeOutput`, or block outputs with `selectedOutputs`. Organization permission groups can hide output, files, or cost.\n\n`includeFileBase64` inlines file bytes. A file or the total above 16 MiB returns `413` naming a download path; download large files individually. `HEAD` checks access with the same authorization as `GET` but skips side effects, returning an empty `200` without payload headers on success.\n\nOAuth scope: `api:read`.",
+        "description": "Read current run state with workspace read access. Request final output and files with `includeOutput`, or block outputs with `selectedOutputs`. Organization permission groups can hide output, files, or cost. A paused run lists every pause point in `paused.points`, with the fields a human pause asks for and its content with resolved secrets redacted; resume one with Resume workflow run.\n\n`includeFileBase64` inlines file bytes. A file or the total above 16 MiB returns `413` naming a download path; download large files individually. `HEAD` checks access with the same authorization as `GET` but skips side effects, returning an empty `200` without payload headers on success.\n\nOAuth scope: `api:read`.",
         "x-sim-operation": "workflows.runs.read",
         "x-oauth-scope": "api:read",
         "tags": ["Workflow Runs"],
@@ -4517,6 +4517,7 @@
                         "startedAt": "2026-08-09T18:04:10.000Z",
                         "endedAt": "2026-08-09T18:04:11.000Z",
                         "durationMs": 1000,
+                        "version": 3,
                         "paused": null,
                         "cost": {
                           "total": 12
@@ -4691,7 +4692,7 @@
       "post": {
         "operationId": "resumeWorkflowRunV2",
         "summary": "Resume workflow run",
-        "description": "Resume one human-in-the-loop pause with workspace write access. The resumed attempt receives a new run ID and returns a synchronous result or queue receipt. A run that originally streamed resumes asynchronously through v2; this endpoint returns no SSE stream.\n\nOAuth scope: `api:write`.",
+        "description": "Resume one human-in-the-loop pause with workspace write access, naming a `contextId` from the run's `paused.points`. The resumed attempt receives a new run ID and returns a synchronous result or queue receipt. A run that originally streamed resumes asynchronously through v2; this endpoint returns no SSE stream.\n\nOAuth scope: `api:write`.",
         "x-sim-operation": "workflows.runs.resume",
         "x-oauth-scope": "api:write",
         "tags": ["Workflow Runs"],
@@ -14916,7 +14917,7 @@
             }
           },
           "run": {
-            "description": "Workflow state and entry point to execute. Omit for the active deployment. Manual execution requires OAuth or personal-key write access and supports synchronous or streamed runs only; `waitTimeoutSeconds` lets a synchronous one continue in the background.",
+            "description": "Workflow state and entry point to execute. Omit for the active deployment; `source: \"deployment\"` with `version` runs that deployment version. Manual execution requires OAuth or personal-key write access and supports synchronous or streamed runs only; `waitTimeoutSeconds` lets a synchronous one continue in the background.",
             "oneOf": [
               {
                 "type": "object",
@@ -14924,7 +14925,13 @@
                   "source": {
                     "type": "string",
                     "const": "deployment",
-                    "description": "Execute the active deployed workflow state."
+                    "description": "Execute a deployed workflow version."
+                  },
+                  "version": {
+                    "description": "Deployment version to execute instead of the active one. Requires an API key or OAuth access token with workspace write access, and the workflow must be deployed. An unknown version returns `404`.",
+                    "type": "integer",
+                    "minimum": 1,
+                    "maximum": 2147483647
                   }
                 },
                 "required": ["source"],
@@ -15244,6 +15251,222 @@
           }
         ]
       },
+      "WorkflowRunPausePoint": {
+        "type": "object",
+        "properties": {
+          "contextId": {
+            "type": "string",
+            "description": "Pause context to name in `contextId` when resuming this point."
+          },
+          "blockId": {
+            "type": "string",
+            "description": "Workflow block that paused."
+          },
+          "blockName": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Name of the block in the deployment version the run executed, or null for a manual run or when the version no longer exists."
+          },
+          "kind": {
+            "type": "string",
+            "enum": ["human", "time"],
+            "description": "`human` waits for a resume request; `time` resumes automatically at `resumeAt`."
+          },
+          "status": {
+            "type": "string",
+            "enum": ["paused", "queued", "resuming", "resumed", "failed"],
+            "description": "Resume state of this point: waiting, queued behind another resume, resuming, resumed, or a failed resume attempt."
+          },
+          "registeredAt": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "ISO 8601 timestamp when the run paused at this point, or null for a point recorded without one.",
+            "format": "date-time"
+          },
+          "resumeAt": {
+            "anyOf": [
+              {
+                "type": "string"
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "ISO 8601 automatic-resume timestamp for a time pause, otherwise null.",
+            "format": "date-time"
+          },
+          "parallel": {
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "parallelId": {
+                    "type": "string",
+                    "description": "Parallel block containing the pause."
+                  },
+                  "branchIndex": {
+                    "type": "integer",
+                    "minimum": -9007199254740991,
+                    "maximum": 9007199254740991,
+                    "description": "Zero-based branch that paused."
+                  },
+                  "branchTotal": {
+                    "anyOf": [
+                      {
+                        "type": "integer",
+                        "minimum": -9007199254740991,
+                        "maximum": 9007199254740991
+                      },
+                      {
+                        "type": "null"
+                      }
+                    ],
+                    "description": "Number of branches, or null when unrecorded."
+                  }
+                },
+                "required": ["parallelId", "branchIndex", "branchTotal"],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Parallel branch of the pause, or null outside a parallel."
+          },
+          "loop": {
+            "anyOf": [
+              {
+                "type": "object",
+                "properties": {
+                  "loopId": {
+                    "type": "string",
+                    "description": "Loop block containing the pause."
+                  },
+                  "iteration": {
+                    "type": "integer",
+                    "minimum": -9007199254740991,
+                    "maximum": 9007199254740991,
+                    "description": "Zero-based iteration that paused."
+                  }
+                },
+                "required": ["loopId", "iteration"],
+                "additionalProperties": false
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Loop iteration of the pause, or null outside a loop."
+          },
+          "inputFields": {
+            "anyOf": [
+              {
+                "type": "array",
+                "items": {
+                  "$ref": "#/components/schemas/WorkflowRunPauseInputField"
+                }
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Fields a human pause asks for, without default values. Labels and descriptions are resolved, so they are withheld when organization permission groups hide execution data. Null then, for a time pause, a pause with no declared form, fields over 64 KiB or not provably free of secrets, or one recorded before pause details were captured."
+          },
+          "display": {
+            "anyOf": [
+              {
+                "description": "Reviewer content value."
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Content the pause presents to its reviewer, with the run's resolved secrets redacted. Null unless `includeOutput=true`, when hidden by organization permission groups, for a time pause, for content over 64 KiB or not provably free of secrets, or for a pause recorded before pause details were captured."
+          },
+          "queuePosition": {
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": -9007199254740991,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Position among pending resume requests for this run, or null when none waits."
+          }
+        },
+        "required": [
+          "contextId",
+          "blockId",
+          "blockName",
+          "kind",
+          "status",
+          "registeredAt",
+          "resumeAt",
+          "parallel",
+          "loop",
+          "inputFields",
+          "display",
+          "queuePosition"
+        ],
+        "additionalProperties": false,
+        "title": "Workflow run pause point",
+        "description": "One point at which a paused run waits."
+      },
+      "WorkflowRunPauseInputField": {
+        "type": "object",
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "Key to supply this field under in the resume `input`."
+          },
+          "label": {
+            "type": "string",
+            "description": "Display label for the field."
+          },
+          "type": {
+            "type": "string",
+            "description": "Declared value type, such as `string`, `number`, or `boolean`."
+          },
+          "description": {
+            "description": "Field help text, when configured.",
+            "type": "string"
+          },
+          "placeholder": {
+            "description": "Placeholder text, when configured.",
+            "type": "string"
+          },
+          "required": {
+            "type": "boolean",
+            "description": "Whether the field is marked required."
+          },
+          "options": {
+            "description": "Selectable options, when the field offers a fixed set.",
+            "type": "array",
+            "items": {
+              "description": "One selectable option."
+            }
+          }
+        },
+        "required": ["name", "label", "type", "required"],
+        "additionalProperties": false,
+        "title": "Pause input field",
+        "description": "One field a human pause asks the resumer to fill."
+      },
       "V2RunFile": {
         "type": "object",
         "properties": {
@@ -15361,6 +15584,19 @@
             ],
             "description": "Run duration in milliseconds, or null while active."
           },
+          "version": {
+            "anyOf": [
+              {
+                "type": "integer",
+                "minimum": -9007199254740991,
+                "maximum": 9007199254740991
+              },
+              {
+                "type": "null"
+              }
+            ],
+            "description": "Deployment version the run executed. Null for a manual run, a queued run not yet started, or a run whose version no longer exists."
+          },
           "paused": {
             "anyOf": [
               {
@@ -15437,6 +15673,13 @@
                   "resumedCount": {
                     "type": "number",
                     "description": "Number of pause points that have resumed."
+                  },
+                  "points": {
+                    "type": "array",
+                    "items": {
+                      "$ref": "#/components/schemas/WorkflowRunPausePoint"
+                    },
+                    "description": "Every point the run is paused at, earliest first, at most 100. Resume one with Resume workflow run, naming its `contextId` and supplying `input`."
                   }
                 },
                 "required": [
@@ -15447,7 +15690,8 @@
                   "blockedOnBlockId",
                   "automaticResumeWaitingReason",
                   "pausePointCount",
-                  "resumedCount"
+                  "resumedCount",
+                  "points"
                 ],
                 "additionalProperties": false
               },
@@ -15538,6 +15782,7 @@
           "startedAt",
           "endedAt",
           "durationMs",
+          "version",
           "paused",
           "cost",
           "error",
@@ -15571,6 +15816,7 @@
               "startedAt": "2026-08-09T18:04:10.000Z",
               "endedAt": "2026-08-09T18:04:11.000Z",
               "durationMs": 1000,
+              "version": 3,
               "paused": null,
               "cost": {
                 "total": 12
diff --git a/apps/docs/scripts/fixtures/content-baseline.json b/apps/docs/scripts/fixtures/content-baseline.json
index 94df7334dd3..88a1d78e393 100644
--- a/apps/docs/scripts/fixtures/content-baseline.json
+++ b/apps/docs/scripts/fixtures/content-baseline.json
@@ -181727,6 +181727,13 @@
       ],
       "expressions": [],
       "codeFences": [
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "32c20ca5dbc0941290361d3ddba31d3585a80493e65c486960e2660fae4c03d0",
+          "bytes": 243,
+          "line": 21
+        },
         {
           "lang": "bash",
           "meta": null,
diff --git a/apps/sim/app/api/v2/workflows/[workflowId]/execute/route.ts b/apps/sim/app/api/v2/workflows/[workflowId]/execute/route.ts
index 24fbbcd3417..a97fe7c4d0a 100644
--- a/apps/sim/app/api/v2/workflows/[workflowId]/execute/route.ts
+++ b/apps/sim/app/api/v2/workflows/[workflowId]/execute/route.ts
@@ -40,7 +40,10 @@ import {
   executeManualWorkflowFromBlockOperation,
   executeManualWorkflowOperation,
 } from '@/lib/workflows/application/execute-manual-workflow'
-import { executeWorkflowOperation } from '@/lib/workflows/application/execute-workflow'
+import {
+  executeWorkflowOperation,
+  executeWorkflowVersionOperation,
+} from '@/lib/workflows/application/execute-workflow'
 import { workflowOperations } from '@/lib/workflows/application/operations'
 import {
   type ExecuteWorkflowServiceFailure,
@@ -316,6 +319,8 @@ type V2ExecuteWorkflowRouteContext = {
  *
  * - Auth: `X-API-Key` (personal/workspace) or the anonymous public-API path for
  *   workflows deployed with `isPublicApi` (actor = owner; sync/stream only).
+ * - `run: { source: 'deployment', version }` runs that deployment version under
+ *   the write-role `workflows.execute_version` operation; keyed callers only.
  * - `async: true` (body flag — v2 has no mode headers) → 202
  *   `{ data: { runId, statusUrl } }`; poll the v2 runs resource.
  * - `stream: true` → SSE passthrough (no `{data}` envelope on event frames).
@@ -422,6 +427,7 @@ export const POST = withRouteHandler(
       if (!parsed.success) return parsed.response
       const body = parsed.data.body
       const manualRun = body.run?.source === 'manual' ? body.run : undefined
+      const pinnedVersion = body.run?.source === 'deployment' ? body.run.version : undefined
 
       if (manualRun && !apiKeyPrincipal) {
         return v2Error(
@@ -439,6 +445,9 @@ export const POST = withRouteHandler(
       ) {
         return v2Error('BAD_REQUEST', 'input and run.entry.useMockPayload cannot be combined')
       }
+      if (pinnedVersion !== undefined && isPublicApiAccess) {
+        return v2Error('BAD_REQUEST', 'run.version requires an OAuth access token or API key')
+      }
 
       const detachable = body.waitTimeoutSeconds !== undefined
       if (detachable && (body.async || body.stream)) {
@@ -544,6 +553,17 @@ export const POST = withRouteHandler(
             },
             request: req,
           })
+        } else if (pinnedVersion !== undefined) {
+          result = await executeWorkflowVersionOperation.execute({
+            principal: apiKeyPrincipal,
+            input: {
+              ...commonInput,
+              input: body.input ?? {},
+              mode: body.async ? 'async' : body.stream ? 'stream' : syncMode,
+              version: pinnedVersion,
+            },
+            request: req,
+          })
         } else {
           result = await executeWorkflowOperation.execute({
             principal: apiKeyPrincipal,
diff --git a/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.test.ts b/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.test.ts
index 12c3f8c0249..54c0fc63784 100644
--- a/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.test.ts
+++ b/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.test.ts
@@ -59,6 +59,7 @@ const baseStatus = {
   startedAt: '2026-07-31T00:00:00.000Z',
   endedAt: '2026-07-31T00:00:05.000Z',
   totalDurationMs: 5000,
+  deploymentVersion: null,
   paused: null,
   cost: { total: 0.02 },
   error: 'Send Email: Invalid credentials',
diff --git a/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.ts b/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.ts
index dab2588457e..9bbf5c353a6 100644
--- a/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.ts
+++ b/apps/sim/app/api/v2/workflows/[workflowId]/runs/[runId]/route.ts
@@ -45,7 +45,13 @@ export const GET = defineV2JsonRoute({
       startedAt: status.startedAt,
       endedAt: status.endedAt,
       durationMs: status.totalDurationMs,
-      paused: status.paused ? v2WorkflowRunStatusSchema.shape.paused.parse(status.paused) : null,
+      version: status.deploymentVersion ?? null,
+      paused: status.paused
+        ? v2WorkflowRunStatusSchema.shape.paused.parse({
+            ...status.paused,
+            points: status.pausePoints ?? [],
+          })
+        : null,
       cost: status.cost,
       error: status.error ? classifyExecutionError(new Error(status.error)) : null,
       output: status.finalOutput,
diff --git a/apps/sim/app/api/workflows/[id]/executions/[executionId]/route.test.ts b/apps/sim/app/api/workflows/[id]/executions/[executionId]/route.test.ts
index f6984733410..1a5ffa73f25 100644
--- a/apps/sim/app/api/workflows/[id]/executions/[executionId]/route.test.ts
+++ b/apps/sim/app/api/workflows/[id]/executions/[executionId]/route.test.ts
@@ -53,6 +53,7 @@ describe('internal execution status route projection subject', () => {
       startedAt: '2026-08-05T12:00:00.000Z',
       endedAt: null,
       totalDurationMs: null,
+      deploymentVersion: null,
       paused: null,
       cost: null,
       error: null,
diff --git a/apps/sim/background/deployed-run-variables.integration.ts b/apps/sim/background/deployed-run-variables.integration.ts
new file mode 100644
index 00000000000..1875397aee3
--- /dev/null
+++ b/apps/sim/background/deployed-run-variables.integration.ts
@@ -0,0 +1,287 @@
+/**
+ * Scheduled and webhook runs against real PostgreSQL: each executes its deployed version with
+ * the variables that version was deployed with, not the editor's saved ones, except for a
+ * version deployed before deployments snapshotted variables, which keeps the saved ones.
+ */
+import { serializePrincipal } from '@sim/auth/principal'
+import { db } from '@sim/db'
+import {
+  permissions,
+  user,
+  webhook,
+  workflow,
+  workflowDeploymentVersion,
+  workflowExecutionLogs,
+  workflowExecutionSnapshots,
+  workflowSchedule,
+  workspace,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { resolveBillingAttribution } from '@/lib/billing/core/attribution'
+import { createWebhookExecutionPrincipal } from '@/lib/webhooks/execution-principal'
+import { getWorkflowExecutionStatus } from '@/lib/workflows/executor/execution-status'
+import { executeScheduleJob } from '@/background/schedule-execution'
+import { executeWebhookJob } from '@/background/webhook-execution'
+
+const ownerId = generateId()
+const workspaceId = generateId()
+const workflowIds: string[] = []
+
+function variables(workflowId: string, greeting: string) {
+  return {
+    greeting: { id: 'greeting', workflowId, name: 'greeting', type: 'plain', value: greeting },
+  }
+}
+
+const SCHEDULE_TRIGGER = {
+  id: 'trigger',
+  type: 'schedule',
+  name: 'Schedule',
+  enabled: true,
+  position: { x: 0, y: 0 },
+  outputs: {},
+  subBlocks: {
+    scheduleType: { id: 'scheduleType', type: 'dropdown', value: 'custom' },
+    cronExpression: { id: 'cronExpression', type: 'short-input', value: '0 0 * * *' },
+  },
+}
+
+const WEBHOOK_TRIGGER = {
+  id: 'trigger',
+  type: 'generic_webhook',
+  name: 'Webhook',
+  enabled: true,
+  position: { x: 0, y: 0 },
+  outputs: {},
+  subBlocks: {},
+  triggerMode: true,
+}
+
+/** Trigger into a Response echoing the `greeting` variable; `variables` omitted for a legacy snapshot. */
+function deployedState(
+  trigger: typeof SCHEDULE_TRIGGER | typeof WEBHOOK_TRIGGER,
+  snapshotVariables: Record<string, unknown> | undefined
+) {
+  return {
+    blocks: {
+      trigger,
+      respond: {
+        id: 'respond',
+        type: 'response',
+        name: 'Respond',
+        enabled: true,
+        position: { x: 300, y: 0 },
+        outputs: {},
+        subBlocks: {
+          dataMode: { id: 'dataMode', type: 'dropdown', value: 'json' },
+          data: { id: 'data', type: 'code', value: '{"greeting": "<variable.greeting>"}' },
+          status: { id: 'status', type: 'short-input', value: '200' },
+        },
+      },
+    },
+    edges: [{ id: 'trigger-respond', source: 'trigger', target: 'respond' }],
+    loops: {},
+    parallels: {},
+    ...(snapshotVariables ? { variables: snapshotVariables } : {}),
+  }
+}
+
+/**
+ * A workflow whose saved variables differ from the deployed ones. With `superseded`, the
+ * returned version is no longer active: a later one with its own variables is.
+ */
+async function deployWorkflow(
+  trigger: typeof SCHEDULE_TRIGGER | typeof WEBHOOK_TRIGGER,
+  { snapshotsVariables, superseded = false }: { snapshotsVariables: boolean; superseded?: boolean }
+) {
+  const workflowId = generateId()
+  const versionId = generateId()
+  workflowIds.push(workflowId)
+  const now = new Date()
+  await db.insert(workflow).values({
+    id: workflowId,
+    userId: ownerId,
+    workspaceId,
+    name: `Deployed variables fixture ${workflowId}`,
+    isDeployed: true,
+    deployedAt: now,
+    variables: variables(workflowId, 'saved'),
+    lastSynced: now,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await db.insert(workflowDeploymentVersion).values({
+    id: versionId,
+    workflowId,
+    version: 1,
+    state: deployedState(
+      trigger,
+      snapshotsVariables ? variables(workflowId, 'deployed') : undefined
+    ),
+    isActive: !superseded,
+  })
+  if (superseded) {
+    await db.insert(workflowDeploymentVersion).values({
+      id: generateId(),
+      workflowId,
+      version: 2,
+      state: deployedState(trigger, variables(workflowId, 'active')),
+      isActive: true,
+    })
+  }
+  return { workflowId, versionId }
+}
+
+async function settledOutput(workflowId: string, executionId: string) {
+  return vi.waitFor(
+    async () => {
+      const status = await getWorkflowExecutionStatus({
+        workflowId,
+        executionId,
+        includeOutput: true,
+        selectedOutputs: [],
+        workspaceId,
+        viewerUserId: ownerId,
+      })
+      if (status?.status !== 'completed') {
+        throw new Error(`Run ${executionId} has not completed: ${status?.status} ${status?.error}`)
+      }
+      return status.finalOutput
+    },
+    { timeout: 20_000, interval: 250 }
+  )
+}
+
+async function runSchedule(workflowId: string, versionId: string) {
+  const scheduleId = generateId()
+  const executionId = generateId()
+  const now = new Date()
+  await db.insert(workflowSchedule).values({
+    id: scheduleId,
+    workflowId,
+    deploymentVersionId: versionId,
+    blockId: 'trigger',
+    cronExpression: '0 0 * * *',
+    triggerType: 'schedule',
+    lastQueuedAt: now,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await executeScheduleJob({
+    scheduleId,
+    workflowId,
+    workspaceId,
+    billingAttribution: await resolveBillingAttribution({ actorUserId: ownerId, workspaceId }),
+    executionId,
+    blockId: 'trigger',
+    deploymentVersionId: versionId,
+    cronExpression: '0 0 * * *',
+    now: now.toISOString(),
+  })
+  return settledOutput(workflowId, executionId)
+}
+
+async function runWebhook(workflowId: string, versionId: string) {
+  const webhookId = generateId()
+  const executionId = generateId()
+  await db.insert(webhook).values({
+    id: webhookId,
+    workflowId,
+    deploymentVersionId: versionId,
+    blockId: 'trigger',
+    path: `deployed-variables-${webhookId}`,
+    provider: 'generic',
+    providerConfig: {},
+  })
+  await executeWebhookJob({
+    webhookId,
+    workflowId,
+    principal: serializePrincipal(
+      createWebhookExecutionPrincipal({ webhookId, workflowId, workspaceId, provider: 'generic' })
+    ),
+    userId: ownerId,
+    billingAttribution: await resolveBillingAttribution({ actorUserId: ownerId, workspaceId }),
+    executionId,
+    provider: 'generic',
+    body: { event: 'ping' },
+    headers: {},
+    method: 'POST',
+    path: `deployed-variables-${webhookId}`,
+    blockId: 'trigger',
+    deploymentVersionId: versionId,
+    workspaceId,
+  })
+  return settledOutput(workflowId, executionId)
+}
+
+beforeAll(async () => {
+  const now = new Date()
+  await db.insert(user).values({
+    id: ownerId,
+    name: 'Deployed variables fixture',
+    email: `${ownerId}@deployed-variables.test`,
+    emailVerified: true,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await insertWorkspaceFixture(db, {
+    id: workspaceId,
+    name: 'Deployed variables fixture',
+    ownerId,
+    billedAccountUserId: ownerId,
+  })
+  await db.insert(permissions).values({
+    id: generateId(),
+    userId: ownerId,
+    entityType: 'workspace',
+    entityId: workspaceId,
+    permissionType: 'admin',
+  })
+})
+
+afterAll(async () => {
+  if (workflowIds.length > 0) {
+    await db
+      .delete(workflowExecutionLogs)
+      .where(inArray(workflowExecutionLogs.workflowId, workflowIds))
+    await db
+      .delete(workflowExecutionSnapshots)
+      .where(inArray(workflowExecutionSnapshots.workflowId, workflowIds))
+  }
+  await deleteWorkspaceFixture(db, eq(workspace.id, workspaceId))
+  await db.delete(user).where(eq(user.id, ownerId))
+  await db.$client.end()
+})
+
+describe('variables a queued deployed run executes with', () => {
+  it('runs a schedule with its deployed variables, not the saved ones', async () => {
+    const { workflowId, versionId } = await deployWorkflow(SCHEDULE_TRIGGER, {
+      snapshotsVariables: true,
+    })
+    await expect(runSchedule(workflowId, versionId)).resolves.toMatchObject({
+      data: { greeting: 'deployed' },
+    })
+  })
+
+  it('runs a webhook delivery admitted on an earlier version with that version variables', async () => {
+    const { workflowId, versionId } = await deployWorkflow(WEBHOOK_TRIGGER, {
+      snapshotsVariables: true,
+      superseded: true,
+    })
+    await expect(runWebhook(workflowId, versionId)).resolves.toMatchObject({
+      data: { greeting: 'deployed' },
+    })
+  })
+
+  it('keeps the saved variables for a version deployed before variables were snapshotted', async () => {
+    const { workflowId, versionId } = await deployWorkflow(SCHEDULE_TRIGGER, {
+      snapshotsVariables: false,
+    })
+    await expect(runSchedule(workflowId, versionId)).resolves.toMatchObject({
+      data: { greeting: 'saved' },
+    })
+  })
+})
diff --git a/apps/sim/background/schedule-execution.ts b/apps/sim/background/schedule-execution.ts
index 533d5eb0063..eeabc810762 100644
--- a/apps/sim/background/schedule-execution.ts
+++ b/apps/sim/background/schedule-execution.ts
@@ -37,7 +37,10 @@ import { cleanupExecutionBase64Cache } from '@/lib/uploads/utils/user-file-base6
 import { executeWorkflowCore } from '@/lib/workflows/executor/execution-core'
 import { handlePostExecutionPauseState } from '@/lib/workflows/executor/pause-persistence'
 import { isRecordedWorkflowFailure } from '@/lib/workflows/executor/recorded-failure'
-import { loadDeployedWorkflowState } from '@/lib/workflows/persistence/utils'
+import {
+  loadDeployedWorkflowState,
+  resolveDeployedRunVariables,
+} from '@/lib/workflows/persistence/utils'
 import { notifyScheduleAutoDisabled } from '@/lib/workflows/schedules/disable-notifications'
 import type { ScheduleDisableReason } from '@/lib/workflows/schedules/disable-reasons'
 import {
@@ -622,7 +625,7 @@ async function runWorkflowExecution({
       metadata,
       workflowRecord,
       input,
-      workflowRecord.variables || {},
+      resolveDeployedRunVariables(deployedData, workflowRecord.variables),
       []
     )
 
diff --git a/apps/sim/background/webhook-execution.ts b/apps/sim/background/webhook-execution.ts
index 660840b0cf2..bd4387132b7 100644
--- a/apps/sim/background/webhook-execution.ts
+++ b/apps/sim/background/webhook-execution.ts
@@ -84,6 +84,7 @@ import {
 import {
   loadDeployedWorkflowState,
   loadWorkflowDeploymentVersionState,
+  resolveDeployedRunVariables,
 } from '@/lib/workflows/persistence/utils'
 import { WEBHOOK_EXECUTION_CONCURRENCY_LIMIT } from '@/background/concurrency-limits'
 import { getBlock } from '@/blocks'
@@ -867,8 +868,6 @@ async function executeWebhookJobInternal(
     throw new Error(`Workflow ${payload.workflowId} has no associated workspace`)
   }
 
-  const workflowVariables = (workflowRecord.variables as Record<string, unknown>) || {}
-
   let deploymentVersionId: string | undefined
   /**
    * Flipped immediately before `executeWorkflowCore` is invoked. While false,
@@ -917,6 +916,7 @@ async function executeWebhookJobInternal(
       }
 
       const { blocks, edges, loops, parallels } = workflowData
+      const workflowVariables = resolveDeployedRunVariables(workflowData, workflowRecord.variables)
       deploymentVersionId =
         'deploymentVersionId' in workflowData
           ? (workflowData.deploymentVersionId as string)
diff --git a/apps/sim/background/workflow-execution.ts b/apps/sim/background/workflow-execution.ts
index 0aa2c684e8a..809b9493ec2 100644
--- a/apps/sim/background/workflow-execution.ts
+++ b/apps/sim/background/workflow-execution.ts
@@ -32,6 +32,7 @@ import {
   RESERVATION_TTL_BUFFER_MS,
 } from '@/lib/core/execution-limits'
 import type { RequestAttribution } from '@/lib/core/utils/request-attribution'
+import { withDatabaseReadRetry } from '@/lib/db/read-retry'
 import {
   isWorkflowStateRejection,
   type PreprocessExecutionError,
@@ -47,6 +48,11 @@ import {
   isRecordedWorkflowFailure,
   resolveDeletedExecutionScope,
 } from '@/lib/workflows/executor/recorded-failure'
+import {
+  loadDeployedWorkflowState,
+  loadWorkflowDeploymentVersionState,
+  resolveDeployedRunVariables,
+} from '@/lib/workflows/persistence/utils'
 import { WORKFLOW_EXECUTION_CONCURRENCY_LIMIT } from '@/background/concurrency-limits'
 import { ExecutionSnapshot } from '@/executor/execution/snapshot'
 import type { ExecutionMetadata } from '@/executor/execution/types'
@@ -106,6 +112,11 @@ export type WorkflowExecutionPayload = {
    */
   enforceCredentialAccess?: boolean
   isPublicApiAccess?: boolean
+  /**
+   * Deployment version validated by the enqueuing use case. Only the id rides the
+   * payload; jobs queued without it run the active deployment.
+   */
+  pinnedDeploymentVersionId?: string
 }
 
 type LegacyWorkflowExecutionPayload = Omit<WorkflowExecutionPayload, 'principal'> & {
@@ -272,6 +283,23 @@ export async function executeWorkflowJob(
         logger.info(`Preprocessing passed. Using actor: ${actorUserId}`, { requestId })
 
         const workflow = preprocessResult.workflowRecord!
+        /**
+         * The version this run executes, loaded once: the core runs this same version's
+         * blocks, so a deploy landing mid-setup cannot pair one version's variables with
+         * another's graph.
+         */
+        const pinnedDeploymentVersionId = payload.pinnedDeploymentVersionId
+        const deployedState = await withDatabaseReadRetry(
+          () =>
+            pinnedDeploymentVersionId
+              ? loadWorkflowDeploymentVersionState(
+                  workflowId,
+                  pinnedDeploymentVersionId,
+                  workspaceId
+                )
+              : loadDeployedWorkflowState(workflowId, workspaceId),
+          { label: 'loadDeployedRunState' }
+        )
 
         const metadata: ExecutionMetadata = {
           requestId,
@@ -286,6 +314,7 @@ export async function executeWorkflowJob(
           triggerType: payload.triggerType || 'api',
           triggerBlockId: payload.triggerBlockId,
           useDraftState: false,
+          pinnedDeploymentVersionId: deployedState.deploymentVersionId,
           startTime: new Date().toISOString(),
           isClientSession: false,
           enforceCredentialAccess: payload.enforceCredentialAccess ?? false,
@@ -299,7 +328,7 @@ export async function executeWorkflowJob(
           metadata,
           workflow,
           payload.input,
-          workflow.variables || {},
+          resolveDeployedRunVariables(deployedState, workflow.variables),
           []
         )
 
diff --git a/apps/sim/executor/execution/engine.ts b/apps/sim/executor/execution/engine.ts
index ffb20f432f9..092c830e2a6 100644
--- a/apps/sim/executor/execution/engine.ts
+++ b/apps/sim/executor/execution/engine.ts
@@ -11,6 +11,7 @@ import {
   serializePauseSnapshot,
 } from '@/executor/execution/snapshot-serializer'
 import type { SerializableExecutionState } from '@/executor/execution/types'
+import { capturePauseDisplay } from '@/executor/human-in-the-loop/utils'
 import type { NodeExecutionOrchestrator } from '@/executor/orchestrators/node'
 import type {
   ExecutionContext,
@@ -651,7 +652,9 @@ export class ExecutionEngine {
     this.context.metadata.status = 'paused'
 
     const snapshotSeed = serializePauseSnapshot(this.context, [], this.dag, this.edgeManager)
+    const registry = this.context.resolvedSecretTraceRegistry
     const pausePoints: PausePoint[] = Array.from(this.pausedBlocks.values()).map((pause) => ({
+      ...capturePauseDisplay(pause, registry),
       contextId: pause.contextId,
       blockId: pause.blockId,
       response: pause.response,
diff --git a/apps/sim/executor/execution/types.ts b/apps/sim/executor/execution/types.ts
index 905dc3ac6ec..36265be745e 100644
--- a/apps/sim/executor/execution/types.ts
+++ b/apps/sim/executor/execution/types.ts
@@ -75,6 +75,12 @@ export interface ExecutionMetadata {
     variables?: Record<string, unknown>
     deploymentVersionId?: string
   }
+  /**
+   * Deployment version a deployed run executes instead of the active one, chosen
+   * and validated by the application use case. A resumed run ignores it: resume
+   * reloads the version its durable log admitted.
+   */
+  pinnedDeploymentVersionId?: string
   largeValueExecutionIds?: string[]
   largeValueKeys?: string[]
   fileKeys?: string[]
diff --git a/apps/sim/executor/human-in-the-loop/utils.ts b/apps/sim/executor/human-in-the-loop/utils.ts
index ef9c8501c7a..2c000374b77 100644
--- a/apps/sim/executor/human-in-the-loop/utils.ts
+++ b/apps/sim/executor/human-in-the-loop/utils.ts
@@ -1,6 +1,22 @@
-import type { ExecutionContext, LoopPauseScope, ParallelPauseScope } from '@/executor/types'
+import { isRecordLike } from '@sim/utils/object'
+import type {
+  ExecutionContext,
+  LoopPauseScope,
+  ParallelPauseScope,
+  PauseInputField,
+  PauseMetadata,
+  PausePoint,
+} from '@/executor/types'
+import { projectResolvedSecretModelJsonContent } from '@/executor/utils/resolved-secret-content-projection'
+import type { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
 import { buildBranchNodeId } from '@/executor/utils/subflow-node-id-codec'
 
+/** Per-part ceiling on captured display content and fields; larger parts are withheld, not truncated. */
+const MAX_PAUSE_DISPLAY_BYTES = 64 * 1024
+
+/** Response keys that drive resume and rendering rather than describe what the reviewer sees. */
+const PAUSE_RESPONSE_CONTROL_KEYS = new Set(['_resume', 'operation', 'inputFormat', 'submission'])
+
 interface NodeMetadataLike {
   nodeId: string
   loopId?: string
@@ -59,3 +75,62 @@ export function mapNodeMetadataToPauseScopes(
     loopScope,
   }
 }
+
+function toPauseInputField(field: unknown): PauseInputField | null {
+  if (!isRecordLike(field) || typeof field.name !== 'string' || !field.name.trim()) return null
+  return {
+    name: field.name,
+    label: typeof field.label === 'string' ? field.label : field.name,
+    type: typeof field.type === 'string' ? field.type : 'string',
+    ...(typeof field.description === 'string' ? { description: field.description } : {}),
+    ...(typeof field.placeholder === 'string' ? { placeholder: field.placeholder } : {}),
+    required: field.required === true,
+    ...(Array.isArray(field.options) ? { options: field.options } : {}),
+  }
+}
+
+/**
+ * The reviewer-facing view of a pause, scrubbed of every secret the run resolved.
+ *
+ * A pause's `response` is persisted as the block produced it, so a reference such as
+ * `{{API_KEY}}` in its configuration is stored resolved. This projects the parts a caller
+ * reading the run may see — the content without resume links, control keys, or API-mode status
+ * and headers, and the input fields without their default values — through the run's committed
+ * secret matches. Content and fields are proven separately: a part whose projection is
+ * unprovable (no registry, an incomplete one, or over {@link MAX_PAUSE_DISPLAY_BYTES}) is null
+ * while the other may survive. Time pauses carry no reviewer content.
+ */
+export function capturePauseDisplay(
+  pause: Pick<PauseMetadata, 'pauseKind' | 'response'>,
+  registry: ResolvedSecretTraceRegistry | undefined
+): Pick<PausePoint, 'displayScrubbed' | 'display' | 'inputFields'> {
+  const withheld = { displayScrubbed: true, display: null, inputFields: null }
+  if (pause.pauseKind !== 'human') return withheld
+
+  const data: unknown = isRecordLike(pause.response) ? pause.response.data : undefined
+  const content = isRecordLike(data)
+    ? Object.fromEntries(
+        Object.entries(data).filter(([key]) => !PAUSE_RESPONSE_CONTROL_KEYS.has(key))
+      )
+    : (data ?? null)
+  const inputFields =
+    isRecordLike(data) && Array.isArray(data.inputFormat)
+      ? data.inputFormat.flatMap((field) => toPauseInputField(field) ?? [])
+      : null
+
+  /** Each part is projected on its own, so content too large to prove withholds only itself. */
+  const project = (value: unknown): unknown => {
+    const projection = projectResolvedSecretModelJsonContent(
+      value,
+      registry,
+      MAX_PAUSE_DISPLAY_BYTES
+    )
+    return projection.safe ? projection.value : null
+  }
+  const projectedFields = inputFields ? project(inputFields) : null
+  return {
+    displayScrubbed: true,
+    display: project(content) ?? null,
+    inputFields: Array.isArray(projectedFields) ? (projectedFields as PauseInputField[]) : null,
+  }
+}
diff --git a/apps/sim/executor/types.ts b/apps/sim/executor/types.ts
index 50e4b108773..6c384a38191 100644
--- a/apps/sim/executor/types.ts
+++ b/apps/sim/executor/types.ts
@@ -97,6 +97,26 @@ export interface PausePoint {
   }
   pauseKind: PauseKind
   resumeAt?: string
+  /**
+   * Set when {@link display} and {@link inputFields} were scrubbed of the run's resolved
+   * secrets as the pause was captured. Points persisted before scrubbing existed lack it, and
+   * readers must expose neither field for them: their `response` was stored unscrubbed.
+   */
+  displayScrubbed?: boolean
+  /** Reviewer-facing pause content without resume links or API-mode status and headers. */
+  display?: unknown
+  /** Fields a human pause asks the resumer to fill, without their default values. */
+  inputFields?: PauseInputField[] | null
+}
+
+export interface PauseInputField {
+  name: string
+  label: string
+  type: string
+  description?: string
+  placeholder?: string
+  required: boolean
+  options?: unknown[]
 }
 
 export interface SerializedSnapshot {
diff --git a/apps/sim/lib/api/contracts/v2/openapi/workflows.ts b/apps/sim/lib/api/contracts/v2/openapi/workflows.ts
index 0eb21e359f1..929402de51e 100644
--- a/apps/sim/lib/api/contracts/v2/openapi/workflows.ts
+++ b/apps/sim/lib/api/contracts/v2/openapi/workflows.ts
@@ -1282,7 +1282,7 @@ const declaredRoutes = [
       applicationOperation: workflowOperations.execute,
       operationId: 'executeWorkflowV2',
       summary: 'Execute workflow',
-      description: `Run the active deployment, or set \`run.source: "manual"\` to run the saved draft. Deployed execution requires workspace read access and OAuth \`api:write\` scope or an API key; public deployments also allow anonymous synchronous or streamed runs. Manual runs require personal-key or OAuth write access and cannot be async.\n\nUse \`async: true\` for a queue receipt, or \`stream: true\` for SSE. For a synchronous run with both flags false, send \`Accept: application/x-ndjson\` for heartbeat frames and a final frame containing \`data\`. With \`waitTimeoutSeconds\`, a synchronous run still going when the wait elapses continues in the background and answers with its run receipt instead: \`202\` on a JSON response, or a closing \`detached\` frame on an NDJSON stream, which keeps its \`200\`. Timeouts return \`200\` with \`status: "failed"\` and \`error.code: "TIMEOUT"\`; inspect run status. See [Streaming](/workflows/deployment/api#streaming) for event formats. ${EXECUTE_OPTION_CONSTRAINTS}\n\nSupply \`X-Run-Id\` to prevent duplicate execution. Reuse returns \`409\`, without replaying results. A \`503\` with \`error.details.code: "ASYNC_ENQUEUE_AMBIGUOUS"\` omits \`Retry-After\` because the run may already have started. Reconcile using the returned run ID; do not start another run with a new or omitted ID.`,
+      description: `Run the active deployment, set \`run: { source: "deployment", version }\` to run an earlier deployment version, or set \`run.source: "manual"\` to run the saved draft. Deployed execution requires workspace read access and OAuth \`api:write\` scope or an API key; public deployments also allow anonymous synchronous or streamed runs. Running a chosen version requires workspace write access and an API key or OAuth access token; an unknown version returns \`404\`. Manual runs require personal-key or OAuth write access and cannot be async.\n\nUse \`async: true\` for a queue receipt, or \`stream: true\` for SSE. For a synchronous run with both flags false, send \`Accept: application/x-ndjson\` for heartbeat frames and a final frame containing \`data\`. With \`waitTimeoutSeconds\`, a synchronous run still going when the wait elapses continues in the background and answers with its run receipt instead: \`202\` on a JSON response, or a closing \`detached\` frame on an NDJSON stream, which keeps its \`200\`. Timeouts return \`200\` with \`status: "failed"\` and \`error.code: "TIMEOUT"\`; inspect run status. See [Streaming](/workflows/deployment/api#streaming) for event formats. ${EXECUTE_OPTION_CONSTRAINTS}\n\nSupply \`X-Run-Id\` to prevent duplicate execution. Reuse returns \`409\`, without replaying results. A \`503\` with \`error.details.code: "ASYNC_ENQUEUE_AMBIGUOUS"\` omits \`Retry-After\` because the run may already have started. Reconcile using the returned run ID; do not start another run with a new or omitted ID.`,
       errors: [
         'BadRequest',
         'Unauthorized',
@@ -1366,7 +1366,7 @@ const declaredRoutes = [
       applicationOperation: workflowOperations.readRun,
       operationId: 'getWorkflowRunV2',
       summary: 'Get workflow run',
-      description: `Read current run state with workspace read access. Request final output and files with \`includeOutput\`, or block outputs with \`selectedOutputs\`. Organization permission groups can hide output, files, or cost.\n\n\`includeFileBase64\` inlines file bytes. A file or the total above 16 MiB returns \`413\` naming a download path; download large files individually. ${HEAD_MIRRORS_GET}`,
+      description: `Read current run state with workspace read access. Request final output and files with \`includeOutput\`, or block outputs with \`selectedOutputs\`. Organization permission groups can hide output, files, or cost. A paused run lists every pause point in \`paused.points\`, with the fields a human pause asks for and its content with resolved secrets redacted; resume one with Resume workflow run.\n\n\`includeFileBase64\` inlines file bytes. A file or the total above 16 MiB returns \`413\` naming a download path; download large files individually. ${HEAD_MIRRORS_GET}`,
       errors: [...RESOURCE_CONFLICT_ERRORS, 'PayloadTooLarge'],
       success: jsonSuccess('The workflow run status.'),
     }),
@@ -1388,6 +1388,7 @@ const declaredRoutes = [
               startedAt: '2026-08-09T18:04:10.000Z',
               endedAt: '2026-08-09T18:04:11.000Z',
               durationMs: 1_000,
+              version: 3,
               paused: null,
               cost: { total: 12 },
               error: null,
@@ -1435,7 +1436,7 @@ const declaredRoutes = [
       operationId: 'resumeWorkflowRunV2',
       summary: 'Resume workflow run',
       description:
-        'Resume one human-in-the-loop pause with workspace write access. The resumed attempt receives a new run ID and returns a synchronous result or queue receipt. A run that originally streamed resumes asynchronously through v2; this endpoint returns no SSE stream.',
+        "Resume one human-in-the-loop pause with workspace write access, naming a `contextId` from the run's `paused.points`. The resumed attempt receives a new run ID and returns a synchronous result or queue receipt. A run that originally streamed resumes asynchronously through v2; this endpoint returns no SSE stream.",
       errors: [...RESOURCE_ERRORS, 'UsageLimitExceeded', 'Conflict', 'PayloadTooLarge'],
       success: {
         byStatus: {
diff --git a/apps/sim/lib/api/contracts/v2/workflows.ts b/apps/sim/lib/api/contracts/v2/workflows.ts
index d608b59c7a6..8f51805f36f 100644
--- a/apps/sim/lib/api/contracts/v2/workflows.ts
+++ b/apps/sim/lib/api/contracts/v2/workflows.ts
@@ -1504,7 +1504,12 @@ export const EXECUTE_OPTION_CONSTRAINTS =
 export const v2WorkflowRunSelectionSchema = z.discriminatedUnion('source', [
   z
     .object({
-      source: z.literal('deployment').describe('Execute the active deployed workflow state.'),
+      source: z.literal('deployment').describe('Execute a deployed workflow version.'),
+      version: versionNumberSchema
+        .optional()
+        .describe(
+          'Deployment version to execute instead of the active one. Requires an API key or OAuth access token with workspace write access, and the workflow must be deployed. An unknown version returns `404`.'
+        ),
     })
     .strict(),
   z
@@ -1569,9 +1574,10 @@ export type V2WorkflowRunSelection = z.input<typeof v2WorkflowRunSelectionSchema
 /**
  * Strict public execute body. Async is body-selected (`async: true`) — v2 has
  * no `X-Execution-Mode`/`X-Stream-Response` headers. `run` selects the public
- * deployment/manual behavior, while internal executor facts (`triggerType`,
- * `useDraftState`, deployment pinning, and source snapshots) remain trusted
- * server-side options and are NEVER wire fields.
+ * deployment/manual behavior (a deployment run may name a version number),
+ * while internal executor facts (`triggerType`, `useDraftState`, deployment
+ * version row ids, and source snapshots) remain trusted server-side options and
+ * are NEVER wire fields.
  *
  * The rejected option combinations are enforced by the route after parsing and
  * described on the fields they constrain; {@link EXECUTE_OPTION_CONSTRAINTS}
@@ -1586,7 +1592,7 @@ export const v2ExecuteWorkflowBodySchema = z
     run: v2WorkflowRunSelectionSchema
       .optional()
       .describe(
-        'Workflow state and entry point to execute. Omit for the active deployment. Manual execution requires OAuth or personal-key write access and supports synchronous or streamed runs only; `waitTimeoutSeconds` lets a synchronous one continue in the background.'
+        'Workflow state and entry point to execute. Omit for the active deployment; `source: "deployment"` with `version` runs that deployment version. Manual execution requires OAuth or personal-key write access and supports synchronous or streamed runs only; `waitTimeoutSeconds` lets a synchronous one continue in the background.'
       ),
     async: z
       .boolean()
@@ -2016,6 +2022,101 @@ export const v2RunFileSchema = z
   })
 export type V2RunFile = z.output<typeof v2RunFileSchema>
 
+const v2PauseInputFieldSchema = z
+  .object({
+    name: z.string().describe('Key to supply this field under in the resume `input`.'),
+    label: z.string().describe('Display label for the field.'),
+    type: z.string().describe('Declared value type, such as `string`, `number`, or `boolean`.'),
+    description: z.string().optional().describe('Field help text, when configured.'),
+    placeholder: z.string().optional().describe('Placeholder text, when configured.'),
+    required: z.boolean().describe('Whether the field is marked required.'),
+    options: z
+      .array(z.unknown().describe('One selectable option.'))
+      .optional()
+      .describe('Selectable options, when the field offers a fixed set.'),
+  })
+  .meta({
+    id: 'WorkflowRunPauseInputField',
+    title: 'Pause input field',
+    description: 'One field a human pause asks the resumer to fill.',
+  })
+
+const v2WorkflowRunPausePointSchema = z
+  .object({
+    contextId: z
+      .string()
+      .describe('Pause context to name in `contextId` when resuming this point.'),
+    blockId: z.string().describe('Workflow block that paused.'),
+    blockName: z
+      .string()
+      .nullable()
+      .describe(
+        'Name of the block in the deployment version the run executed, or null for a manual run or when the version no longer exists.'
+      ),
+    kind: z
+      .enum(['human', 'time'])
+      .describe('`human` waits for a resume request; `time` resumes automatically at `resumeAt`.'),
+    status: z
+      .enum(['paused', 'queued', 'resuming', 'resumed', 'failed'])
+      .describe(
+        'Resume state of this point: waiting, queued behind another resume, resuming, resumed, or a failed resume attempt.'
+      ),
+    registeredAt: z
+      .string()
+      .nullable()
+      .describe(
+        'ISO 8601 timestamp when the run paused at this point, or null for a point recorded without one.'
+      )
+      .meta({ format: 'date-time' }),
+    resumeAt: z
+      .string()
+      .nullable()
+      .describe('ISO 8601 automatic-resume timestamp for a time pause, otherwise null.')
+      .meta({ format: 'date-time' }),
+    parallel: z
+      .object({
+        parallelId: z.string().describe('Parallel block containing the pause.'),
+        branchIndex: z.number().int().describe('Zero-based branch that paused.'),
+        branchTotal: z
+          .number()
+          .int()
+          .nullable()
+          .describe('Number of branches, or null when unrecorded.'),
+      })
+      .nullable()
+      .describe('Parallel branch of the pause, or null outside a parallel.'),
+    loop: z
+      .object({
+        loopId: z.string().describe('Loop block containing the pause.'),
+        iteration: z.number().int().describe('Zero-based iteration that paused.'),
+      })
+      .nullable()
+      .describe('Loop iteration of the pause, or null outside a loop.'),
+    inputFields: z
+      .array(v2PauseInputFieldSchema)
+      .nullable()
+      .describe(
+        'Fields a human pause asks for, without default values. Labels and descriptions are resolved, so they are withheld when organization permission groups hide execution data. Null then, for a time pause, a pause with no declared form, fields over 64 KiB or not provably free of secrets, or one recorded before pause details were captured.'
+      ),
+    display: z
+      .unknown()
+      .describe('Reviewer content value.')
+      .nullable()
+      .describe(
+        "Content the pause presents to its reviewer, with the run's resolved secrets redacted. Null unless `includeOutput=true`, when hidden by organization permission groups, for a time pause, for content over 64 KiB or not provably free of secrets, or for a pause recorded before pause details were captured."
+      ),
+    queuePosition: z
+      .number()
+      .int()
+      .nullable()
+      .describe('Position among pending resume requests for this run, or null when none waits.'),
+  })
+  .meta({
+    id: 'WorkflowRunPausePoint',
+    title: 'Workflow run pause point',
+    description: 'One point at which a paused run waits.',
+  })
+
 /**
  * The polled run resource. `queued` is backfilled from the async job
  * queue before the worker writes the durable log row — v1's jobs endpoint 404
@@ -2059,8 +2160,22 @@ export const v2WorkflowRunStatusSchema = z
       .number()
       .nullable()
       .describe('Run duration in milliseconds, or null while active.'),
+    version: z
+      .number()
+      .int()
+      .nullable()
+      .describe(
+        'Deployment version the run executed. Null for a manual run, a queued run not yet started, or a run whose version no longer exists.'
+      ),
     paused: workflowExecutionPausedDetailSchema
       .omit({ pausedExecutionId: true })
+      .extend({
+        points: z
+          .array(v2WorkflowRunPausePointSchema)
+          .describe(
+            'Every point the run is paused at, earliest first, at most 100. Resume one with Resume workflow run, naming its `contextId` and supplying `input`.'
+          ),
+      })
       .nullable()
       .describe('Current pause details, or null when the run is not paused.'),
     cost: z
diff --git a/apps/sim/lib/api/contracts/workflows.ts b/apps/sim/lib/api/contracts/workflows.ts
index e9aa60fca3c..b5eabc856fa 100644
--- a/apps/sim/lib/api/contracts/workflows.ts
+++ b/apps/sim/lib/api/contracts/workflows.ts
@@ -612,6 +612,11 @@ const workflowExecutionStatusResponseSchema = z.object({
   startedAt: z.string(),
   endedAt: z.string().nullable(),
   totalDurationMs: z.number().nullable(),
+  /**
+   * Deployment version number the run executed; null for draft or not-yet-recorded runs.
+   * Optional so a client deployed ahead of the server still parses its response.
+   */
+  deploymentVersion: z.number().int().nullable().optional(),
   paused: workflowExecutionPausedDetailSchema.nullable(),
   cost: z.object({ total: z.number() }).nullable(),
   error: z.string().nullable(),
diff --git a/apps/sim/lib/api/mcp/generated/v2-operations.ts b/apps/sim/lib/api/mcp/generated/v2-operations.ts
index 11edb9d0bcd..0b7a66f8915 100644
--- a/apps/sim/lib/api/mcp/generated/v2-operations.ts
+++ b/apps/sim/lib/api/mcp/generated/v2-operations.ts
@@ -1252,7 +1252,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2ExecuteWorkflowContract,
     summary: 'Execute workflow',
     description:
-      'Run the active deployment, or set `run.source: "manual"` to run the saved draft. Deployed execution requires workspace read access and OAuth `api:write` scope or an API key; public deployments also allow anonymous synchronous or streamed runs. Manual runs require personal-key or OAuth write access and cannot be async.\n\nUse `async: true` for a queue receipt, or `stream: true` for SSE. For a synchronous run with both flags false, send `Accept: application/x-ndjson` for heartbeat frames and a final frame containing `data`. With `waitTimeoutSeconds`, a synchronous run still going when the wait elapses continues in the background and answers with its run receipt instead: `202` on a JSON response, or a closing `detached` frame on an NDJSON stream, which keeps its `200`. Timeouts return `200` with `status: "failed"` and `error.code: "TIMEOUT"`; inspect run status. See [Streaming](/workflows/deployment/api#streaming) for event formats. Input descriptions specify compatible modes; invalid combinations return `400`.\n\nSupply `X-Run-Id` to prevent duplicate execution. Reuse returns `409`, without replaying results. A `503` with `error.details.code: "ASYNC_ENQUEUE_AMBIGUOUS"` omits `Retry-After` because the run may already have started. Reconcile using the returned run ID; do not start another run with a new or omitted ID.\n\nOAuth scope: `api:write`.',
+      'Run the active deployment, set `run: { source: "deployment", version }` to run an earlier deployment version, or set `run.source: "manual"` to run the saved draft. Deployed execution requires workspace read access and OAuth `api:write` scope or an API key; public deployments also allow anonymous synchronous or streamed runs. Running a chosen version requires workspace write access and an API key or OAuth access token; an unknown version returns `404`. Manual runs require personal-key or OAuth write access and cannot be async.\n\nUse `async: true` for a queue receipt, or `stream: true` for SSE. For a synchronous run with both flags false, send `Accept: application/x-ndjson` for heartbeat frames and a final frame containing `data`. With `waitTimeoutSeconds`, a synchronous run still going when the wait elapses continues in the background and answers with its run receipt instead: `202` on a JSON response, or a closing `detached` frame on an NDJSON stream, which keeps its `200`. Timeouts return `200` with `status: "failed"` and `error.code: "TIMEOUT"`; inspect run status. See [Streaming](/workflows/deployment/api#streaming) for event formats. Input descriptions specify compatible modes; invalid combinations return `400`.\n\nSupply `X-Run-Id` to prevent duplicate execution. Reuse returns `409`, without replaying results. A `503` with `error.details.code: "ASYNC_ENQUEUE_AMBIGUOUS"` omits `Retry-After` because the run may already have started. Reconcile using the returned run ID; do not start another run with a new or omitted ID.\n\nOAuth scope: `api:write`.',
     handler: () =>
       import('@/app/api/v2/workflows/[workflowId]/execute/route').then((route) => route.POST),
   },
@@ -1653,7 +1653,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2GetWorkflowRunContract,
     summary: 'Get workflow run',
     description:
-      'Read current run state with workspace read access. Request final output and files with `includeOutput`, or block outputs with `selectedOutputs`. Organization permission groups can hide output, files, or cost.\n\n`includeFileBase64` inlines file bytes. A file or the total above 16 MiB returns `413` naming a download path; download large files individually. `HEAD` checks access with the same authorization as `GET` but skips side effects, returning an empty `200` without payload headers on success.\n\nOAuth scope: `api:read`.',
+      'Read current run state with workspace read access. Request final output and files with `includeOutput`, or block outputs with `selectedOutputs`. Organization permission groups can hide output, files, or cost. A paused run lists every pause point in `paused.points`, with the fields a human pause asks for and its content with resolved secrets redacted; resume one with Resume workflow run.\n\n`includeFileBase64` inlines file bytes. A file or the total above 16 MiB returns `413` naming a download path; download large files individually. `HEAD` checks access with the same authorization as `GET` but skips side effects, returning an empty `200` without payload headers on success.\n\nOAuth scope: `api:read`.',
     handler: () =>
       import('@/app/api/v2/workflows/[workflowId]/runs/[runId]/route').then((route) => route.GET),
   },
@@ -2576,7 +2576,7 @@ export const V2_MCP_OPERATIONS = {
     contract: v2ResumeWorkflowContract,
     summary: 'Resume workflow run',
     description:
-      'Resume one human-in-the-loop pause with workspace write access. The resumed attempt receives a new run ID and returns a synchronous result or queue receipt. A run that originally streamed resumes asynchronously through v2; this endpoint returns no SSE stream.\n\nOAuth scope: `api:write`.',
+      "Resume one human-in-the-loop pause with workspace write access, naming a `contextId` from the run's `paused.points`. The resumed attempt receives a new run ID and returns a synchronous result or queue receipt. A run that originally streamed resumes asynchronously through v2; this endpoint returns no SSE stream.\n\nOAuth scope: `api:write`.",
     handler: () =>
       import('@/app/api/v2/workflows/[workflowId]/runs/[runId]/resume/route').then(
         (route) => route.POST
diff --git a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
index 2f85e7c1452..a9dcd23f9db 100644
--- a/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
+++ b/apps/sim/lib/mothership/__integration__/content-delivery-compat.baseline.json
@@ -853,6 +853,7 @@
         "startedAt": "<time>",
         "status": "completed",
         "trigger": "api",
+        "version": null,
         "workflowId": "<workflow>"
       }
     }
diff --git a/apps/sim/lib/mothership/tasks/application/tasks.test.ts b/apps/sim/lib/mothership/tasks/application/tasks.test.ts
index 4bb20950534..40b92511bd4 100644
--- a/apps/sim/lib/mothership/tasks/application/tasks.test.ts
+++ b/apps/sim/lib/mothership/tasks/application/tasks.test.ts
@@ -253,6 +253,7 @@ describe('worker HTTP contracts', () => {
         startedAt: '2026-09-06T00:00:00.000Z',
         endedAt: '2026-09-06T00:00:01.000Z',
         durationMs: 1000,
+        version: null,
         paused: null,
         cost: null,
         error: null,
diff --git a/apps/sim/lib/workflows/application/execute-workflow-version.integration.ts b/apps/sim/lib/workflows/application/execute-workflow-version.integration.ts
new file mode 100644
index 00000000000..2548c457267
--- /dev/null
+++ b/apps/sim/lib/workflows/application/execute-workflow-version.integration.ts
@@ -0,0 +1,243 @@
+/**
+ * Deployed runs against real PostgreSQL through the execute use cases: a pinned run executes
+ * the version it named rather than the active one, on the sync and the async path, and an
+ * unpinned async run reads the deployed variables a sync run reads, not the editor's draft.
+ */
+import { db } from '@sim/db'
+import {
+  asyncJobs,
+  permissions,
+  user,
+  workflow,
+  workflowDeploymentVersion,
+  workflowExecutionLogs,
+  workflowExecutionSnapshots,
+  workspace,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import {
+  executeWorkflowOperation,
+  executeWorkflowVersionOperation,
+} from '@/lib/workflows/application/execute-workflow'
+import { getWorkflowExecutionStatus } from '@/lib/workflows/executor/execution-status'
+
+const ownerId = generateId()
+const workspaceId = generateId()
+const workflowId = generateId()
+const principal = createSessionPrincipal({ userId: ownerId, sessionId: generateId() })
+const versionIds = { one: generateId(), two: generateId() }
+const jobIds: string[] = []
+
+/** One variable whose value differs between the deployed versions and the editor's draft. */
+function variables(greeting: string) {
+  return {
+    greeting: { id: 'greeting', workflowId, name: 'greeting', type: 'plain', value: greeting },
+  }
+}
+
+/** Start into a Response that echoes the version label and the `greeting` variable. */
+function deployedState(label: string, greeting: string) {
+  return {
+    blocks: {
+      start: {
+        id: 'start',
+        type: 'start_trigger',
+        name: 'Start',
+        enabled: true,
+        position: { x: 0, y: 0 },
+        outputs: {},
+        subBlocks: {},
+      },
+      respond: {
+        id: 'respond',
+        type: 'response',
+        name: 'Respond',
+        enabled: true,
+        position: { x: 300, y: 0 },
+        outputs: {},
+        subBlocks: {
+          dataMode: { id: 'dataMode', type: 'dropdown', value: 'json' },
+          data: {
+            id: 'data',
+            type: 'code',
+            value: `{"version": "${label}", "greeting": "<variable.greeting>"}`,
+          },
+          status: { id: 'status', type: 'short-input', value: '200' },
+        },
+      },
+    },
+    edges: [{ id: 'start-respond', source: 'start', target: 'respond' }],
+    loops: {},
+    parallels: {},
+    variables: variables(greeting),
+  }
+}
+
+const runInput = (mode: 'sync' | 'async') => ({
+  workflowId,
+  requestId: generateId(),
+  input: {},
+  mode,
+  requestHeaders: new Headers(),
+})
+
+async function logDeploymentVersionId(executionId: string) {
+  const [row] = await db
+    .select({ deploymentVersionId: workflowExecutionLogs.deploymentVersionId })
+    .from(workflowExecutionLogs)
+    .where(eq(workflowExecutionLogs.executionId, executionId))
+  return row?.deploymentVersionId
+}
+
+/** Waits for a queued run, executed in-process by the database job backend, to settle. */
+async function settledRun(executionId: string) {
+  return vi.waitFor(
+    async () => {
+      const status = await getWorkflowExecutionStatus({
+        workflowId,
+        executionId,
+        includeOutput: true,
+        selectedOutputs: [],
+        workspaceId,
+        viewerUserId: ownerId,
+      })
+      if (status?.status !== 'completed' && status?.status !== 'failed') {
+        throw new Error(`Run ${executionId} has not settled: ${status?.status}`)
+      }
+      return status
+    },
+    { timeout: 20_000, interval: 250 }
+  )
+}
+
+beforeAll(async () => {
+  const now = new Date()
+  await db.insert(user).values({
+    id: ownerId,
+    name: 'Pinned execute fixture',
+    email: `${ownerId}@pinned-execute.test`,
+    emailVerified: true,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await insertWorkspaceFixture(db, {
+    id: workspaceId,
+    name: 'Pinned execute fixture',
+    ownerId,
+    billedAccountUserId: ownerId,
+  })
+  await db.insert(permissions).values({
+    id: generateId(),
+    userId: ownerId,
+    entityType: 'workspace',
+    entityId: workspaceId,
+    permissionType: 'admin',
+  })
+  await db.insert(workflow).values({
+    id: workflowId,
+    userId: ownerId,
+    workspaceId,
+    name: 'Pinned execute fixture',
+    isDeployed: true,
+    deployedAt: now,
+    variables: variables('draft'),
+    lastSynced: now,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await db.insert(workflowDeploymentVersion).values([
+    {
+      id: versionIds.one,
+      workflowId,
+      version: 1,
+      state: deployedState('one', 'deployed-one'),
+      isActive: false,
+    },
+    {
+      id: versionIds.two,
+      workflowId,
+      version: 2,
+      state: deployedState('two', 'deployed-two'),
+      isActive: true,
+    },
+  ])
+})
+
+afterAll(async () => {
+  await db.delete(workflowExecutionLogs).where(eq(workflowExecutionLogs.workflowId, workflowId))
+  await db
+    .delete(workflowExecutionSnapshots)
+    .where(eq(workflowExecutionSnapshots.workflowId, workflowId))
+  if (jobIds.length > 0) await db.delete(asyncJobs).where(inArray(asyncJobs.id, jobIds))
+  await deleteWorkspaceFixture(db, eq(workspace.id, workspaceId))
+  await db.delete(user).where(eq(user.id, ownerId))
+  await db.$client.end()
+})
+
+describe('executing a deployed workflow against real Postgres', () => {
+  it('runs the pinned version, not the active one, and records it on the log', async () => {
+    const result = await executeWorkflowVersionOperation.execute({
+      principal,
+      input: { ...runInput('sync'), version: 1 },
+    })
+
+    expect(result).toMatchObject({
+      ok: true,
+      status: 'completed',
+      output: { data: { version: 'one', greeting: 'deployed-one' } },
+    })
+    if (!result.ok || !('status' in result)) throw new Error('Expected a settled sync run')
+    expect(await logDeploymentVersionId(result.executionId)).toBe(versionIds.one)
+  })
+
+  it('answers not_found for a version the workflow never deployed, before any run starts', async () => {
+    await expect(
+      executeWorkflowVersionOperation.execute({
+        principal,
+        input: { ...runInput('sync'), version: 99 },
+      })
+    ).rejects.toMatchObject({ code: 'not_found' })
+  })
+
+  it('carries the pin through the async queue and runs that version in the worker', async () => {
+    const result = await executeWorkflowVersionOperation.execute({
+      principal,
+      input: { ...runInput('async'), version: 1 },
+    })
+    if (!result.ok || !('queued' in result)) throw new Error('Expected a queued run')
+    jobIds.push(result.jobId)
+
+    const [job] = await db.select().from(asyncJobs).where(eq(asyncJobs.id, result.jobId))
+    expect(job.payload).toMatchObject({ pinnedDeploymentVersionId: versionIds.one })
+
+    const run = await settledRun(result.executionId)
+    expect(run).toMatchObject({
+      status: 'completed',
+      deploymentVersion: 1,
+      finalOutput: { data: { version: 'one', greeting: 'deployed-one' } },
+    })
+  })
+
+  it('runs an unpinned async run with the active deployment variables, as a sync run does', async () => {
+    const sync = await executeWorkflowOperation.execute({ principal, input: runInput('sync') })
+    expect(sync).toMatchObject({
+      status: 'completed',
+      output: { data: { version: 'two', greeting: 'deployed-two' } },
+    })
+
+    const queued = await executeWorkflowOperation.execute({ principal, input: runInput('async') })
+    if (!queued.ok || !('queued' in queued)) throw new Error('Expected a queued run')
+    jobIds.push(queued.jobId)
+
+    const run = await settledRun(queued.executionId)
+    expect(run).toMatchObject({
+      status: 'completed',
+      deploymentVersion: 2,
+      finalOutput: { data: { version: 'two', greeting: 'deployed-two' } },
+    })
+  })
+})
diff --git a/apps/sim/lib/workflows/application/execute-workflow.ts b/apps/sim/lib/workflows/application/execute-workflow.ts
index 125f393f787..e5f744fd607 100644
--- a/apps/sim/lib/workflows/application/execute-workflow.ts
+++ b/apps/sim/lib/workflows/application/execute-workflow.ts
@@ -1,16 +1,21 @@
-import type { Principal } from '@sim/auth/principal'
+import type { Principal, WorkflowExecutionPrincipal } from '@sim/auth/principal'
 import { resolvePrincipalAttribution } from '@sim/auth/principal'
+import { OrchestrationError } from '@/lib/core/orchestration/types'
 import {
   inlinesRunFiles,
   withholdUnadmittedInlineFiles,
 } from '@/lib/workflows/application/admit-run-files'
 import { defineAuthorizedWorkflowUseCase } from '@/lib/workflows/application/authorized-workflow-use-case'
-import { resolveActiveWorkflowApplicationContext } from '@/lib/workflows/application/context'
+import {
+  type ActiveWorkflowApplicationContext,
+  resolveActiveWorkflowApplicationContext,
+} from '@/lib/workflows/application/context'
 import { workflowOperations } from '@/lib/workflows/application/operations'
 import {
   type ExecuteWorkflowServiceResult,
   executeWorkflowService,
 } from '@/lib/workflows/executor/execute-service'
+import { getWorkflowDeploymentVersionId } from '@/lib/workflows/persistence/utils'
 
 export interface ExecuteWorkflowInput {
   workflowId: string
@@ -39,37 +44,72 @@ function authenticatesExecutionCredentials(principal: Principal): boolean {
   return principal.kind !== 'workspace_api_key'
 }
 
+async function executeDeployedWorkflow(
+  principal: WorkflowExecutionPrincipal,
+  context: ActiveWorkflowApplicationContext,
+  input: ExecuteWorkflowInput,
+  deploymentVersionId?: string
+): Promise<ExecuteWorkflowServiceResult> {
+  const attribution = resolvePrincipalAttribution(principal, {
+    workspaceBillingOwnerUserId: context.billedAccountUserId,
+  })
+  const result = await executeWorkflowService({
+    workflowId: context.workflowId,
+    principal,
+    userId: attribution.attributedUserId,
+    input: input.input,
+    triggerType: 'api',
+    requestId: input.requestId,
+    executionId: input.executionId,
+    callChain: input.callChain,
+    useAuthenticatedUserAsActor: authenticatesExecutionCredentials(principal),
+    workflowRecord: context.workflow,
+    deploymentVersionId,
+    includeFileBase64: inlinesRunFiles(principal, input.includeFileBase64, input.mode),
+    base64MaxBytes: input.base64MaxBytes,
+    selectedOutputs: input.selectedOutputs,
+    rateLimitCounter: input.mode === 'async' ? 'async' : 'sync',
+    requestedTimeoutSeconds: input.requestedTimeoutSeconds,
+    abortSignal: input.abortSignal,
+    mode: input.mode,
+    detachable: input.detachable,
+    requestHeaders: input.requestHeaders,
+    includeThinking: input.includeThinking,
+    includeToolCalls: input.includeToolCalls,
+  })
+  return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
+}
+
 export const executeWorkflowOperation = defineAuthorizedWorkflowUseCase({
   operation: workflowOperations.execute,
   resolveContext: ({ input }: { input: ExecuteWorkflowInput }) =>
     resolveActiveWorkflowApplicationContext({ workflowId: input.workflowId }),
+  execute: ({ principal, context, input }) => executeDeployedWorkflow(principal, context, input),
+})
+
+interface ExecuteWorkflowVersionInput extends ExecuteWorkflowInput {
+  /** Deployment version number to run instead of the active deployment. */
+  version: number
+}
+
+/**
+ * Runs a chosen deployment version of a deployed workflow. Picking which graph
+ * runs is a deployment decision, so it needs write access where running the
+ * active deployment needs read. The workflow must still be deployed: the
+ * service's deployment check applies to a pinned run as to any deployed one.
+ */
+export const executeWorkflowVersionOperation = defineAuthorizedWorkflowUseCase({
+  operation: workflowOperations.executeVersion,
+  resolveContext: ({ input }: { input: ExecuteWorkflowVersionInput }) =>
+    resolveActiveWorkflowApplicationContext({ workflowId: input.workflowId }),
   async execute({ principal, context, input }): Promise<ExecuteWorkflowServiceResult> {
-    const attribution = resolvePrincipalAttribution(principal, {
-      workspaceBillingOwnerUserId: context.billedAccountUserId,
-    })
-    const result = await executeWorkflowService({
-      workflowId: context.workflowId,
-      principal,
-      userId: attribution.attributedUserId,
-      input: input.input,
-      triggerType: 'api',
-      requestId: input.requestId,
-      executionId: input.executionId,
-      callChain: input.callChain,
-      useAuthenticatedUserAsActor: authenticatesExecutionCredentials(principal),
-      workflowRecord: context.workflow,
-      includeFileBase64: inlinesRunFiles(principal, input.includeFileBase64, input.mode),
-      base64MaxBytes: input.base64MaxBytes,
-      selectedOutputs: input.selectedOutputs,
-      rateLimitCounter: input.mode === 'async' ? 'async' : 'sync',
-      requestedTimeoutSeconds: input.requestedTimeoutSeconds,
-      abortSignal: input.abortSignal,
-      mode: input.mode,
-      detachable: input.detachable,
-      requestHeaders: input.requestHeaders,
-      includeThinking: input.includeThinking,
-      includeToolCalls: input.includeToolCalls,
-    })
-    return withholdUnadmittedInlineFiles(principal, context.workspaceId, result)
+    const deploymentVersionId = await getWorkflowDeploymentVersionId(
+      context.workflowId,
+      input.version
+    )
+    if (!deploymentVersionId) {
+      throw new OrchestrationError('not_found', 'Version not found')
+    }
+    return executeDeployedWorkflow(principal, context, input, deploymentVersionId)
   },
 })
diff --git a/apps/sim/lib/workflows/application/operations.ts b/apps/sim/lib/workflows/application/operations.ts
index e23b8bcba8f..4f2e9bfb0fb 100644
--- a/apps/sim/lib/workflows/application/operations.ts
+++ b/apps/sim/lib/workflows/application/operations.ts
@@ -483,6 +483,16 @@ export const workflowOperations = {
     contentDelivery: 'sourced',
     ...ALL_WORKFLOW_PRINCIPAL_POLICY,
   }),
+  // permission-group-exempt: running a chosen deployment version is governed by workspace role; public_api.use withholds the unauthenticated surface, which does not reach this operation
+  executeVersion: defineWorkspaceOperation({
+    id: 'workflows.execute_version',
+    oauthScope: 'api:write',
+    minimumRole: 'write',
+    workspaceApiKey: 'allow',
+    capability: 'none',
+    contentDelivery: 'sourced',
+    ...ALL_WORKFLOW_PRINCIPAL_POLICY,
+  }),
   // permission-group-exempt: a manual run is governed by workspace role; public_api.use withholds the unauthenticated surface, which does not reach this operation
   executeManual: defineWorkspaceOperation({
     id: 'workflows.manual.execute',
diff --git a/apps/sim/lib/workflows/application/read-workflow-run-pause.integration.ts b/apps/sim/lib/workflows/application/read-workflow-run-pause.integration.ts
new file mode 100644
index 00000000000..8675835f357
--- /dev/null
+++ b/apps/sim/lib/workflows/application/read-workflow-run-pause.integration.ts
@@ -0,0 +1,316 @@
+/**
+ * A deployed run that pauses at a human-in-the-loop block, executed in-process against real
+ * PostgreSQL: the pause's reviewer content is stored and read back with the run's resolved
+ * secret redacted, and the run detail withholds that content on the same terms as the run's
+ * output, while the pause's input fields stay readable.
+ */
+import { db } from '@sim/db'
+import {
+  member,
+  organization,
+  pausedExecutions,
+  permissionGroup,
+  permissionGroupMember,
+  permissionGroupWorkspace,
+  permissions,
+  resumeQueue,
+  user,
+  workflow,
+  workflowDeploymentVersion,
+  workflowExecutionLogs,
+  workflowExecutionSnapshots,
+  workspace,
+  workspaceEnvironment,
+} from '@sim/db/schema'
+import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
+import { createSessionPrincipal } from '@sim/testing/factories/principal.factory'
+import { generateId } from '@sim/utils/id'
+import { eq, inArray } from 'drizzle-orm'
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest'
+import { encryptSecret } from '@/lib/core/security/encryption'
+import { executeWorkflowOperation } from '@/lib/workflows/application/execute-workflow'
+import { readWorkflowRun } from '@/lib/workflows/application/read-workflow-run'
+import { PauseResumeManager } from '@/lib/workflows/executor/human-in-the-loop-manager'
+import type { PausePoint } from '@/executor/types'
+
+const organizationId = generateId()
+const ownerId = generateId()
+const restrictedId = generateId()
+const workspaceId = generateId()
+const workflowId = generateId()
+const owner = createSessionPrincipal({ userId: ownerId, sessionId: generateId() })
+const restricted = createSessionPrincipal({ userId: restrictedId, sessionId: generateId() })
+const SECRET = `resolved-secret-${generateId()}`
+
+const deployedState = {
+  blocks: {
+    start: {
+      id: 'start',
+      type: 'start_trigger',
+      name: 'Start',
+      enabled: true,
+      position: { x: 0, y: 0 },
+      outputs: {},
+      subBlocks: {},
+    },
+    approval: {
+      id: 'approval',
+      type: 'human_in_the_loop',
+      name: 'Approval',
+      enabled: true,
+      position: { x: 300, y: 0 },
+      outputs: {},
+      subBlocks: {
+        builderData: {
+          id: 'builderData',
+          type: 'response-format',
+          value: [
+            { id: 'summary', name: 'summary', type: 'string', value: 'Token is {{API_KEY}}' },
+          ],
+        },
+        inputFormat: {
+          id: 'inputFormat',
+          type: 'input-format',
+          value: [{ id: 'approved', name: 'approved', type: 'boolean', required: true }],
+        },
+      },
+    },
+  },
+  edges: [{ id: 'start-approval', source: 'start', target: 'approval' }],
+  loops: {},
+  parallels: {},
+  variables: {},
+}
+
+async function pausedRun(): Promise<string> {
+  const result = await executeWorkflowOperation.execute({
+    principal: owner,
+    input: {
+      workflowId,
+      requestId: generateId(),
+      input: {},
+      mode: 'sync',
+      requestHeaders: new Headers(),
+    },
+  })
+  expect(result).toMatchObject({ ok: true, status: 'paused' })
+  if (!result.ok || !('status' in result)) throw new Error('Expected a settled sync run')
+  const { executionId } = result
+  await vi.waitFor(
+    async () => {
+      const [row] = await db
+        .select({ id: pausedExecutions.id })
+        .from(pausedExecutions)
+        .where(eq(pausedExecutions.executionId, executionId))
+      if (!row) throw new Error('Pause not yet published')
+    },
+    { timeout: 20_000, interval: 250 }
+  )
+  return executionId
+}
+
+function readRun(
+  principal: typeof owner,
+  runId: string,
+  { includeOutput }: { includeOutput: boolean }
+) {
+  return readWorkflowRun.execute({
+    principal,
+    input: { workflowId, runId, includeOutput, selectedOutputs: [] },
+  })
+}
+
+const REDACTED_DISPLAY = {
+  responseStructure: [{ name: 'summary', type: 'string', value: 'Token is {{API_KEY}}' }],
+}
+const INPUT_FIELDS = [{ name: 'approved', label: 'approved', type: 'boolean', required: true }]
+
+beforeAll(async () => {
+  const now = new Date()
+  await db.insert(user).values(
+    [ownerId, restrictedId].map((id) => ({
+      id,
+      name: 'Paused run fixture',
+      email: `${id}@paused-run.test`,
+      emailVerified: true,
+      createdAt: now,
+      updatedAt: now,
+    }))
+  )
+  await db.insert(organization).values({
+    id: organizationId,
+    name: 'Paused run fixture',
+    slug: organizationId,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await db.insert(member).values(
+    [ownerId, restrictedId].map((userId) => ({
+      id: generateId(),
+      userId,
+      organizationId,
+      role: userId === ownerId ? 'owner' : 'member',
+      createdAt: now,
+    }))
+  )
+  await insertWorkspaceFixture(db, {
+    id: workspaceId,
+    name: 'Paused run fixture',
+    ownerId,
+    billedAccountUserId: ownerId,
+    organizationId,
+    workspaceMode: 'organization',
+  })
+  await db.insert(permissions).values([
+    {
+      id: generateId(),
+      userId: ownerId,
+      entityType: 'workspace',
+      entityId: workspaceId,
+      permissionType: 'admin',
+    },
+    {
+      id: generateId(),
+      userId: restrictedId,
+      entityType: 'workspace',
+      entityId: workspaceId,
+      permissionType: 'read',
+    },
+  ])
+  const restrictedGroupId = generateId()
+  await db.insert(permissionGroup).values([
+    {
+      id: generateId(),
+      organizationId,
+      name: 'Everyone',
+      createdBy: ownerId,
+      isDefault: true,
+      config: {},
+    },
+    {
+      id: restrictedGroupId,
+      organizationId,
+      name: 'No execution data',
+      createdBy: ownerId,
+      config: { hideTraceSpans: true },
+    },
+  ])
+  await db.insert(permissionGroupWorkspace).values({
+    id: generateId(),
+    permissionGroupId: restrictedGroupId,
+    workspaceId,
+    organizationId,
+  })
+  await db.insert(permissionGroupMember).values({
+    id: generateId(),
+    permissionGroupId: restrictedGroupId,
+    organizationId,
+    userId: restrictedId,
+  })
+  await db.insert(workspaceEnvironment).values({
+    id: generateId(),
+    workspaceId,
+    variables: { API_KEY: (await encryptSecret(SECRET)).encrypted },
+  })
+  await db.insert(workflow).values({
+    id: workflowId,
+    userId: ownerId,
+    workspaceId,
+    name: 'Paused run fixture',
+    isDeployed: true,
+    deployedAt: now,
+    lastSynced: now,
+    createdAt: now,
+    updatedAt: now,
+  })
+  await db.insert(workflowDeploymentVersion).values({
+    id: generateId(),
+    workflowId,
+    version: 1,
+    state: deployedState,
+    isActive: true,
+  })
+})
+
+afterAll(async () => {
+  await db.delete(pausedExecutions).where(eq(pausedExecutions.workflowId, workflowId))
+  await db.delete(workflowExecutionLogs).where(eq(workflowExecutionLogs.workflowId, workflowId))
+  await db
+    .delete(workflowExecutionSnapshots)
+    .where(eq(workflowExecutionSnapshots.workflowId, workflowId))
+  await deleteWorkspaceFixture(db, eq(workspace.id, workspaceId))
+  await db.delete(organization).where(eq(organization.id, organizationId))
+  await db.delete(user).where(inArray(user.id, [ownerId, restrictedId]))
+  await db.$client.end()
+})
+
+describe('a deployed run paused at a human-in-the-loop block', () => {
+  it('stores and returns its reviewer content with the resolved secret redacted', async () => {
+    const runId = await pausedRun()
+
+    const [row] = await db
+      .select({ pausePoints: pausedExecutions.pausePoints })
+      .from(pausedExecutions)
+      .where(eq(pausedExecutions.executionId, runId))
+    const [stored] = Object.values(row.pausePoints as Record<string, PausePoint>)
+    expect(stored).toMatchObject({
+      displayScrubbed: true,
+      display: REDACTED_DISPLAY,
+      inputFields: INPUT_FIELDS,
+    })
+
+    const run = await readRun(owner, runId, { includeOutput: true })
+    expect(run.pausePoints).toEqual([
+      expect.objectContaining({
+        blockId: 'approval',
+        blockName: 'Approval',
+        kind: 'human',
+        display: REDACTED_DISPLAY,
+        inputFields: INPUT_FIELDS,
+      }),
+    ])
+    expect(JSON.stringify(run)).not.toContain(SECRET)
+  })
+
+  it('withholds reviewer content unless output was asked for, keeping the input fields', async () => {
+    const runId = await pausedRun()
+
+    const run = await readRun(owner, runId, { includeOutput: false })
+    expect(run.pausePoints).toEqual([
+      expect.objectContaining({ display: null, inputFields: INPUT_FIELDS }),
+    ])
+  })
+
+  it('withholds reviewer content and resolved input fields from a viewer whose group hides execution data', async () => {
+    const runId = await pausedRun()
+
+    const run = await readRun(restricted, runId, { includeOutput: true })
+    expect(run.pausePoints).toEqual([expect.objectContaining({ display: null, inputFields: null })])
+  })
+
+  it('lists the paused parent run points when read by a settled resume attempt id', async () => {
+    const runId = await pausedRun()
+    const attempt = await PauseResumeManager.enqueueOrStartResume({
+      executionId: runId,
+      workflowId,
+      contextId: 'approval',
+      resumeInput: {},
+      userId: ownerId,
+    })
+    /** The attempt settled without finishing the run, which still waits at its pause. */
+    await db
+      .update(resumeQueue)
+      .set({ status: 'completed', completedAt: new Date() })
+      .where(eq(resumeQueue.newExecutionId, attempt.resumeExecutionId))
+
+    const run = await readRun(owner, attempt.resumeExecutionId, { includeOutput: true })
+    expect(run).toMatchObject({ status: 'paused' })
+    expect(run.pausePoints).toEqual([
+      expect.objectContaining({
+        contextId: 'approval',
+        display: REDACTED_DISPLAY,
+        inputFields: INPUT_FIELDS,
+      }),
+    ])
+  })
+})
diff --git a/apps/sim/lib/workflows/application/read-workflow-run.ts b/apps/sim/lib/workflows/application/read-workflow-run.ts
index ad29de11189..62c79d8020d 100644
--- a/apps/sim/lib/workflows/application/read-workflow-run.ts
+++ b/apps/sim/lib/workflows/application/read-workflow-run.ts
@@ -15,7 +15,10 @@ import {
   getWorkflowRunFiles,
   type WorkflowRunFileDescriptor,
 } from '@/lib/workflows/executor/execution-run-files'
-import { getProjectedWorkflowExecutionStatus } from '@/lib/workflows/executor/execution-status'
+import {
+  getProjectedWorkflowExecutionStatus,
+  readPausedRunPoints,
+} from '@/lib/workflows/executor/execution-status'
 
 /**
  * Selectors this resource can never answer, so the caller hears about them.
@@ -82,7 +85,7 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
         viewerUserId: logProjectionSubjectUserId(principal),
       })
       if (!projected) throw new OrchestrationError('not_found', 'Run not found')
-      const { status, projection } = projected
+      const { status, projection, stateExecutionId } = projected
 
       /**
        * A run whose `blockOutputs` the viewer's group withholds joins the same
@@ -148,7 +151,35 @@ export const readWorkflowRun = defineAuthorizedWorkflowUseCase({
           : []
       }
 
-      return { ...status, files }
+      /**
+       * Every pause point of a paused run, so a caller can resume any of them by
+       * `contextId`, not only the earliest one `paused` summarizes. Read from the
+       * execution whose state answered the status, so a resume attempt reporting its
+       * parent's pause lists the parent's points.
+       *
+       * A point's `display` is what the block rendered from upstream outputs, so it
+       * follows `finalOutput`'s gating: withheld unless output was asked for and the
+       * viewer's group shows execution data. `inputFields` are resolved before the
+       * pause is captured, so a label or description can carry upstream values too:
+       * they are withheld from a viewer whose group hides execution data.
+       *
+       * permission-group-enforced: logs.trace_spans
+       */
+      const showsDisplay = input.includeOutput && !projection.hideTraceSpans
+      const pausePoints = status.paused
+        ? (
+            (await readPausedRunPoints({
+              workflowId: context.workflowId,
+              executionId: stateExecutionId,
+            })) ?? []
+          ).map((point) => ({
+            ...point,
+            display: showsDisplay ? point.display : null,
+            inputFields: projection.hideTraceSpans ? null : point.inputFields,
+          }))
+        : null
+
+      return { ...status, files, pausePoints }
     } catch (error) {
       if (error instanceof FunctionalOutputsUnavailableError) {
         throw new OrchestrationError('conflict', FUNCTIONAL_OUTPUTS_UNAVAILABLE_MESSAGE)
diff --git a/apps/sim/lib/workflows/executor/enqueue-execution.ts b/apps/sim/lib/workflows/executor/enqueue-execution.ts
index 8c32ba067c2..fae9cb0079b 100644
--- a/apps/sim/lib/workflows/executor/enqueue-execution.ts
+++ b/apps/sim/lib/workflows/executor/enqueue-execution.ts
@@ -39,6 +39,8 @@ export interface EnqueueWorkflowExecutionParams {
   /** Identity decisions the enqueuing surface made; the worker cannot re-derive them. */
   enforceCredentialAccess?: boolean
   isPublicApiAccess?: boolean
+  /** Deployment version the run executes instead of the active one. */
+  pinnedDeploymentVersionId?: string
 }
 
 /**
@@ -86,6 +88,7 @@ export async function enqueueWorkflowExecution(
     trustedInitialResolvedSecretTraceProvenance,
     enforceCredentialAccess,
     isPublicApiAccess,
+    pinnedDeploymentVersionId,
   } = params
   const asyncLogger = logger.withMetadata({
     requestId,
@@ -124,6 +127,7 @@ export async function enqueueWorkflowExecution(
     admissionCompleted: true,
     executionTimeoutMs,
     trustedInitialResolvedSecretTraceProvenance,
+    pinnedDeploymentVersionId,
   }
 
   let jobQueue: Awaited<ReturnType<typeof getJobQueue>>
diff --git a/apps/sim/lib/workflows/executor/execute-service.ts b/apps/sim/lib/workflows/executor/execute-service.ts
index 5438f6a0776..cab18957181 100644
--- a/apps/sim/lib/workflows/executor/execute-service.ts
+++ b/apps/sim/lib/workflows/executor/execute-service.ts
@@ -88,7 +88,10 @@ export interface ExecuteWorkflowServiceParams {
   /** Pre-fetched workflow row (already authorized by the caller). */
   workflowRecord?: WorkflowRecord
   upstreamBillingAttribution?: BillingAttributionSnapshot
-  /** Pin execution to a specific deployment version (MCP bridge). */
+  /**
+   * Run this deployment version instead of the active one (MCP bridge, v2 execute
+   * with `version`). The id must already be validated against `workflowId`.
+   */
   deploymentVersionId?: string
   includeFileBase64?: boolean
   base64MaxBytes?: number
@@ -473,6 +476,7 @@ export async function executeWorkflowService(
         enforceCredentialAccess: useAuthenticatedUserAsActor,
         isPublicApiAccess,
         executionTimeoutMs: preprocessResult.executionTimeout.async,
+        pinnedDeploymentVersionId: deploymentVersionId,
       })
       executionIdClaimCommitted = enqueue.retainExecutionClaim
       if (enqueue.outcome === 'rejected') {
@@ -627,6 +631,7 @@ export async function executeWorkflowService(
               triggerBlockId,
               useDraftState,
               draftState,
+              pinnedDeploymentVersionId: deploymentVersionId,
               runFromBlock,
               stopAfterBlockId,
               onStream,
@@ -678,6 +683,7 @@ export async function executeWorkflowService(
       triggerType,
       triggerBlockId,
       useDraftState,
+      pinnedDeploymentVersionId: deploymentVersionId,
       startTime: new Date().toISOString(),
       isClientSession: false,
       enforceCredentialAccess: useAuthenticatedUserAsActor,
diff --git a/apps/sim/lib/workflows/executor/execute-workflow.ts b/apps/sim/lib/workflows/executor/execute-workflow.ts
index 052cd0d7deb..6d227db04fb 100644
--- a/apps/sim/lib/workflows/executor/execute-workflow.ts
+++ b/apps/sim/lib/workflows/executor/execute-workflow.ts
@@ -60,6 +60,8 @@ export interface ExecuteWorkflowOptions {
   draftState?: NormalizedWorkflowData
   /** Immutable workflow state selected by a trusted server-side trigger boundary. */
   workflowStateOverride?: NonNullable<ExecutionMetadata['workflowStateOverride']>
+  /** See {@link ExecutionMetadata.pinnedDeploymentVersionId}. */
+  pinnedDeploymentVersionId?: string
   /** Stop execution after this block completes. Used for "run until block" feature. */
   stopAfterBlockId?: string
   /** Workflow test run: mocked blocks await these hooks instead of running. */
@@ -172,6 +174,7 @@ export async function executeWorkflow(
       triggerBlockId: streamConfig?.triggerBlockId,
       useDraftState: streamConfig?.useDraftState ?? false,
       workflowStateOverride: streamConfig?.workflowStateOverride,
+      pinnedDeploymentVersionId: streamConfig?.pinnedDeploymentVersionId,
       startTime: new Date().toISOString(),
       isClientSession: false,
       enforceCredentialAccess: streamConfig?.enforceCredentialAccess ?? false,
diff --git a/apps/sim/lib/workflows/executor/execution-core.ts b/apps/sim/lib/workflows/executor/execution-core.ts
index 9bcad561ff9..6ffa938f2c0 100644
--- a/apps/sim/lib/workflows/executor/execution-core.ts
+++ b/apps/sim/lib/workflows/executor/execution-core.ts
@@ -686,6 +686,10 @@ async function executeWorkflowCoreImpl(
   if (resumeFromSnapshot && !useDraftState && !resumeDeploymentVersionId) {
     throw new Error('Deployed resume requires its admitted deployment version')
   }
+  const pinnedDeploymentVersionId = metadata.pinnedDeploymentVersionId
+  if (pinnedDeploymentVersionId && (useDraftState || metadata.workflowStateOverride)) {
+    throw new Error('A pinned deployment version cannot run draft or overridden workflow state')
+  }
 
   let processedInput = input || {}
   let deploymentVersionId: string | undefined
@@ -724,22 +728,25 @@ async function executeWorkflowCoreImpl(
      * on the environment load, so the two are awaited concurrently below.
      */
     const loadWorkflowState = async () => {
-      if (resumeFromSnapshot && !useDraftState) {
-        if (!resumeDeploymentVersionId) {
-          throw new Error('Deployed resume requires its admitted deployment version')
-        }
-        const deployedData = await loadWorkflowDeploymentVersionState(
+      /** A deployed resume reloads the version its log admitted; a pinned run, its pin. */
+      const versionId =
+        resumeFromSnapshot && !useDraftState ? resumeDeploymentVersionId : pinnedDeploymentVersionId
+      if (versionId) {
+        const versionData = await loadWorkflowDeploymentVersionState(
           workflowId,
-          resumeDeploymentVersionId,
+          versionId,
           providedWorkspaceId
         )
-        logger.info('Using admitted historical deployment state (resumed execution)', { requestId })
+        logger.info('Using a selected deployment version state', {
+          requestId,
+          resumed: resumeFromSnapshot,
+        })
         return {
-          blocks: deployedData.blocks,
-          edges: deployedData.edges,
-          loops: deployedData.loops,
-          parallels: deployedData.parallels,
-          deploymentVersionId: deployedData.deploymentVersionId,
+          blocks: versionData.blocks,
+          edges: versionData.edges,
+          loops: versionData.loops,
+          parallels: versionData.parallels,
+          deploymentVersionId: versionData.deploymentVersionId,
         }
       }
 
diff --git a/apps/sim/lib/workflows/executor/execution-status.test.ts b/apps/sim/lib/workflows/executor/execution-status.test.ts
index f69cd41431a..f72c3feb4be 100644
--- a/apps/sim/lib/workflows/executor/execution-status.test.ts
+++ b/apps/sim/lib/workflows/executor/execution-status.test.ts
@@ -454,6 +454,7 @@ describe('getWorkflowExecutionStatus settled resume attempts', () => {
       startedAt: '2026-08-05T12:00:01.000Z',
       endedAt: '2026-08-05T12:00:05.000Z',
       totalDurationMs: 4000,
+      deploymentVersion: null,
       paused: null,
       cost: { total: 0.5 },
       error: null,
diff --git a/apps/sim/lib/workflows/executor/execution-status.ts b/apps/sim/lib/workflows/executor/execution-status.ts
index ec854781039..e3462c5d879 100644
--- a/apps/sim/lib/workflows/executor/execution-status.ts
+++ b/apps/sim/lib/workflows/executor/execution-status.ts
@@ -1,5 +1,11 @@
 import { db } from '@sim/db'
-import { pausedExecutions, resumeQueue, workflowExecutionLogs } from '@sim/db/schema'
+import {
+  pausedExecutions,
+  resumeQueue,
+  workflowDeploymentVersion,
+  workflowExecutionLogs,
+} from '@sim/db/schema'
+import { compareStrings } from '@sim/utils/string'
 import { and, eq, inArray, sql } from 'drizzle-orm'
 import type { WorkflowExecutionStatusResponse } from '@/lib/api/contracts/workflows'
 import { getJobQueue } from '@/lib/core/async-jobs'
@@ -15,8 +21,10 @@ import {
   WORKFLOW_EXECUTION_JOB_ID_PREFIX,
 } from '@/lib/workflows/executor/execution-job-ids'
 import { normalizePausePoints } from '@/lib/workflows/executor/execution-state'
+import { PauseResumeManager } from '@/lib/workflows/executor/human-in-the-loop-manager'
 import { getAutomaticResumeWaitingMetadata } from '@/lib/workflows/executor/paused-execution-metadata'
-import type { PausePoint } from '@/executor/types'
+import type { PauseInputField, PausePoint, ResumeStatus } from '@/executor/types'
+import { extractBaseBlockId } from '@/executor/utils/subflow-node-id-codec'
 
 /**
  * Reads a single execution's status resource — the log row, the paused-state
@@ -89,7 +97,8 @@ function extractJobFinalOutput(output: unknown): unknown | null {
 
 function projectQueueJob(
   job: Job,
-  input: Pick<GetWorkflowExecutionStatusInput, 'executionId' | 'includeOutput' | 'workflowId'>
+  input: Pick<GetWorkflowExecutionStatusInput, 'executionId' | 'includeOutput' | 'workflowId'>,
+  deploymentVersion: number | null
 ): WorkflowExecutionStatusResponse {
   const status: WorkflowExecutionStatusResponse['status'] =
     job.status === 'pending' ? 'queued' : job.status === 'processing' ? 'running' : job.status
@@ -105,6 +114,7 @@ function projectQueueJob(
     startedAt: startedAt.toISOString(),
     endedAt: endedAt?.toISOString() ?? null,
     totalDurationMs: endedAt ? endedAt.getTime() - startedAt.getTime() : null,
+    deploymentVersion,
     paused: null,
     cost: null,
     error: status === 'failed' ? (job.error ?? 'Execution failed') : null,
@@ -241,6 +251,11 @@ function projectExecutionStatus(
 export interface ProjectedWorkflowExecutionStatus {
   status: WorkflowExecutionStatusResponse
   projection: LogFieldProjection
+  /**
+   * The execution whose recorded state answered: the run itself, or the parent run a settled
+   * resume attempt continued. Further reads of the run's state (its pause points) use this id.
+   */
+  stateExecutionId: string
 }
 
 /**
@@ -260,14 +275,18 @@ export interface ProjectedWorkflowExecutionStatus {
 export async function getProjectedWorkflowExecutionStatus(
   input: GetWorkflowExecutionStatusInput
 ): Promise<ProjectedWorkflowExecutionStatus | null> {
-  const status = await readWorkflowExecutionStatus(input)
-  if (!status) return null
+  const resolved = await readWorkflowExecutionStatus(input)
+  if (!resolved) return null
   const projection = await resolveLogFieldProjection(
     input.viewerUserId,
     input.workspaceId,
     input.workspaceOrganizationId
   )
-  return { status: projectExecutionStatus(status, projection), projection }
+  return {
+    status: projectExecutionStatus(resolved.status, projection),
+    projection,
+    stateExecutionId: resolved.stateExecutionId,
+  }
 }
 
 /**
@@ -298,9 +317,40 @@ function executionDataReadByPoll(
   )
 }
 
+/** The deployment version number a run's log recorded, or null when it recorded none. */
+async function readRunDeploymentVersion(
+  workflowId: string,
+  executionId: string
+): Promise<number | null> {
+  const [row] = await db
+    .select({ version: workflowDeploymentVersion.version })
+    .from(workflowExecutionLogs)
+    .innerJoin(
+      workflowDeploymentVersion,
+      eq(workflowDeploymentVersion.id, workflowExecutionLogs.deploymentVersionId)
+    )
+    .where(
+      and(
+        eq(workflowExecutionLogs.executionId, executionId),
+        eq(workflowExecutionLogs.workflowId, workflowId)
+      )
+    )
+    .limit(1)
+  return row?.version ?? null
+}
+
+/**
+ * A status resource and the execution whose recorded state answered it: the run itself, or
+ * for a settled resume attempt with no log row of its own, the parent run it continued.
+ */
+interface ResolvedExecutionStatus {
+  status: WorkflowExecutionStatusResponse
+  stateExecutionId: string
+}
+
 async function readWorkflowExecutionStatus(
   input: GetWorkflowExecutionStatusInput
-): Promise<WorkflowExecutionStatusResponse | null> {
+): Promise<ResolvedExecutionStatus | null> {
   const { workflowId, executionId, includeOutput, selectedOutputs } = input
 
   const [logRow] = await db
@@ -316,8 +366,13 @@ async function readWorkflowExecutionStatus(
       totalDurationMs: workflowExecutionLogs.totalDurationMs,
       executionData: executionDataReadByPoll(input),
       costTotal: workflowExecutionLogs.costTotal,
+      deploymentVersion: workflowDeploymentVersion.version,
     })
     .from(workflowExecutionLogs)
+    .leftJoin(
+      workflowDeploymentVersion,
+      eq(workflowDeploymentVersion.id, workflowExecutionLogs.deploymentVersionId)
+    )
     .where(
       and(
         eq(workflowExecutionLogs.executionId, executionId),
@@ -360,18 +415,31 @@ async function readWorkflowExecutionStatus(
     ...(!logRow ? [`${WORKFLOW_EXECUTION_JOB_ID_PREFIX}${executionId}`] : []),
   ]
 
+  /**
+   * An active resume continues its parent run on the version the parent admitted, so it
+   * reports that version before it has a log row of its own, as it does once it settles.
+   */
+  const deploymentVersion =
+    logRow?.deploymentVersion ??
+    (projectedResume
+      ? await readRunDeploymentVersion(workflowId, projectedResume.parentExecutionId)
+      : null)
+
   if (queueJobIds.length > 0) {
     const jobQueue = await getJobQueue()
     for (const jobId of queueJobIds) {
       const job = await jobQueue.getJob(jobId)
       if (!job || job.metadata.workflowId !== workflowId) continue
-      return projectQueueJob(job, { executionId, includeOutput, workflowId })
+      return {
+        status: projectQueueJob(job, { executionId, includeOutput, workflowId }, deploymentVersion),
+        stateExecutionId: executionId,
+      }
     }
   }
 
   if (projectedResume) {
     const startedAt = projectedResume.claimedAt ?? projectedResume.queuedAt
-    return {
+    const status: WorkflowExecutionStatusResponse = {
       executionId,
       workflowId,
       status: 'queued',
@@ -380,12 +448,14 @@ async function readWorkflowExecutionStatus(
       startedAt: startedAt.toISOString(),
       endedAt: null,
       totalDurationMs: null,
+      deploymentVersion,
       paused: null,
       cost: null,
       error: null,
       finalOutput: null,
       blockOutputs: null,
     }
+    return { status, stateExecutionId: executionId }
   }
 
   if (!logRow) {
@@ -394,7 +464,12 @@ async function readWorkflowExecutionStatus(
       ...input,
       executionId: resumeAttempt.parentExecutionId,
     })
-    return run ? projectSettledResumeAttempt(executionId, resumeAttempt, run) : null
+    return run
+      ? {
+          status: projectSettledResumeAttempt(executionId, resumeAttempt, run.status),
+          stateExecutionId: run.stateExecutionId,
+        }
+      : null
   }
 
   const [pausedRow] = await db
@@ -452,6 +527,7 @@ async function readWorkflowExecutionStatus(
     startedAt: logRow.startedAt.toISOString(),
     endedAt: logRow.endedAt?.toISOString() ?? null,
     totalDurationMs: logRow.totalDurationMs ?? null,
+    deploymentVersion: logRow.deploymentVersion ?? null,
     paused,
     cost,
   }
@@ -460,7 +536,10 @@ async function readWorkflowExecutionStatus(
   const readsExecutionData =
     selectedOutputs.length > 0 || statusesReadingExecutionData(includeOutput).includes(status)
   if (!readsExecutionData) {
-    return { ...resource, error: null, finalOutput: null, blockOutputs: null }
+    return {
+      status: { ...resource, error: null, finalOutput: null, blockOutputs: null },
+      stateExecutionId: executionId,
+    }
   }
 
   const requestedBlockIds = [
@@ -489,5 +568,150 @@ async function readWorkflowExecutionStatus(
       ? pickSelectedOutputs(selectedOutputs, materialized.blockOutputs)
       : null
 
-  return { ...resource, error, finalOutput, blockOutputs }
+  return {
+    status: { ...resource, error, finalOutput, blockOutputs },
+    stateExecutionId: executionId,
+  }
+}
+
+/** Most pause points a run detail lists; a run over it lists its earliest registered points. */
+const MAX_PAUSED_RUN_POINTS = 100
+
+/** One pause point of a paused run, as a caller reading the run may see it. */
+export interface PausedRunPoint {
+  contextId: string
+  blockId: string
+  blockName: string | null
+  kind: 'human' | 'time'
+  status: ResumeStatus
+  /** Null for a point recorded without a registration time. */
+  registeredAt: string | null
+  resumeAt: string | null
+  parallel: { parallelId: string; branchIndex: number; branchTotal: number | null } | null
+  loop: { loopId: string; iteration: number } | null
+  inputFields: PauseInputField[] | null
+  display: unknown
+  queuePosition: number | null
+}
+
+/**
+ * Names of `blockIds` in the deployment version the run executed, read inside the
+ * database so the version's state never leaves it. Empty for a run with no recorded
+ * version (a manual run) or whose version no longer exists.
+ */
+async function readRunBlockNames(
+  workflowId: string,
+  executionId: string,
+  blockIds: string[]
+): Promise<Map<string, string>> {
+  if (blockIds.length === 0) return new Map()
+  const [row] = await db
+    .select({
+      names: sql<Record<string, string | null> | null>`(
+        select jsonb_object_agg(b.key, b.value ->> 'name')
+        from json_each(${workflowDeploymentVersion.state} -> 'blocks') as b
+        where b.key in (${sql.join(
+          blockIds.map((id) => sql`${id}`),
+          sql`, `
+        )})
+      )`,
+    })
+    .from(workflowExecutionLogs)
+    .innerJoin(
+      workflowDeploymentVersion,
+      eq(workflowDeploymentVersion.id, workflowExecutionLogs.deploymentVersionId)
+    )
+    .where(
+      and(
+        eq(workflowExecutionLogs.executionId, executionId),
+        eq(workflowExecutionLogs.workflowId, workflowId)
+      )
+    )
+    .limit(1)
+  const names = new Map<string, string>()
+  for (const [id, name] of Object.entries(row?.names ?? {})) {
+    if (typeof name === 'string' && name) names.set(id, name)
+  }
+  return names
+}
+
+/**
+ * The pause points of a paused run, earliest registered first and capped at
+ * {@link MAX_PAUSED_RUN_POINTS}, or null when the run has no paused record.
+ *
+ * Reads only `pause_points`, never the execution snapshot. `display` and
+ * `inputFields` come only from points scrubbed of the run's resolved secrets when
+ * they were captured; an older point's stored response was never scrubbed, so both
+ * are null for it. Resume links and API-mode response status and headers are never
+ * part of a point.
+ */
+export async function readPausedRunPoints(input: {
+  workflowId: string
+  executionId: string
+}): Promise<PausedRunPoint[] | null> {
+  const { workflowId, executionId } = input
+  const [row] = await db
+    .select({ pausePoints: pausedExecutions.pausePoints })
+    .from(pausedExecutions)
+    .where(
+      and(
+        eq(pausedExecutions.executionId, executionId),
+        eq(pausedExecutions.workflowId, workflowId)
+      )
+    )
+    .limit(1)
+  if (!row) return null
+
+  // Positions count the whole pending queue, so it is read unpaged: it holds a few columns per
+  // waiting point, never more than the `pause_points` already loaded above.
+  const pendingResumes = await db
+    .select({
+      contextId: resumeQueue.contextId,
+      status: resumeQueue.status,
+      queuedAt: resumeQueue.queuedAt,
+    })
+    .from(resumeQueue)
+    .where(and(eq(resumeQueue.parentExecutionId, executionId), eq(resumeQueue.status, 'pending')))
+    .orderBy(resumeQueue.queuedAt)
+  const queuePositions = PauseResumeManager.computeQueuePositions(
+    pendingResumes.map((entry) => ({
+      contextId: entry.contextId,
+      status: entry.status,
+      queuedAt: entry.queuedAt?.toISOString() ?? null,
+    }))
+  )
+
+  const points = PauseResumeManager.mapPausePoints(row.pausePoints, queuePositions)
+    .sort((a, b) => compareStrings(a.registeredAt ?? '', b.registeredAt ?? ''))
+    .slice(0, MAX_PAUSED_RUN_POINTS)
+  const baseBlockId = (point: PausePoint) => extractBaseBlockId(point.blockId ?? point.contextId)
+  const names = await readRunBlockNames(workflowId, executionId, [
+    ...new Set(points.map(baseBlockId)),
+  ])
+
+  return points.map((point) => {
+    const blockId = baseBlockId(point)
+    return {
+      contextId: point.contextId,
+      blockId,
+      blockName: names.get(blockId) ?? null,
+      kind: point.pauseKind === 'time' ? 'time' : 'human',
+      status: point.resumeStatus,
+      registeredAt: point.registeredAt ?? null,
+      resumeAt: point.resumeAt ?? null,
+      parallel: point.parallelScope
+        ? {
+            parallelId: point.parallelScope.parallelId,
+            branchIndex: point.parallelScope.branchIndex,
+            branchTotal: point.parallelScope.branchTotal ?? null,
+          }
+        : null,
+      loop: point.loopScope
+        ? { loopId: point.loopScope.loopId, iteration: point.loopScope.iteration }
+        : null,
+      inputFields: point.inputFields ?? null,
+      display: point.display ?? null,
+      queuePosition: point.queuePosition ?? null,
+    }
+  })
 }
diff --git a/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts b/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts
index 7687162d637..286e91edb6f 100644
--- a/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts
+++ b/apps/sim/lib/workflows/executor/human-in-the-loop-manager.ts
@@ -266,6 +266,21 @@ function getSnapshotWorkspaceId(snapshotValue: unknown): string | undefined {
   return typeof metadata.workspaceId === 'string' ? metadata.workspaceId : undefined
 }
 
+/**
+ * The pause display fields of a point captured with scrubbing. A point persisted before
+ * scrubbing existed stored its response unscrubbed, so it carries none of them.
+ */
+function scrubbedPauseDisplay(
+  point: Pick<PausePoint, 'displayScrubbed' | 'display' | 'inputFields'>
+): Pick<PausePoint, 'displayScrubbed' | 'display' | 'inputFields'> {
+  if (point.displayScrubbed !== true) return {}
+  return {
+    displayScrubbed: true,
+    display: point.display ?? null,
+    inputFields: point.inputFields ?? null,
+  }
+}
+
 function isResumablePausedStatus(status: string): boolean {
   return RESUMABLE_PAUSED_STATUSES.includes(status as (typeof RESUMABLE_PAUSED_STATUSES)[number])
 }
@@ -605,6 +620,7 @@ export class PauseResumeManager {
         resumeLinks: point.resumeLinks,
         pauseKind: point.pauseKind,
         resumeAt: point.resumeAt,
+        ...scrubbedPauseDisplay(point),
       }
       return acc
     }, {})
@@ -3608,12 +3624,12 @@ export class PauseResumeManager {
         entry.contextId === contextId && (entry.status === 'claimed' || entry.status === 'pending')
     )
 
-    // The selected pause point's full `response.data` is already returned via
-    // `pausePoint` below; strip it from `execution.pausePoints` so a large
-    // HITL display payload isn't duplicated in full within the same response.
+    // The selected pause point's full `response.data` and `display` are already
+    // returned via `pausePoint` below; strip both from `execution.pausePoints` so a
+    // large HITL display payload isn't duplicated in full within the same response.
     const execution: PausedExecutionDetail = {
       ...detail,
-      pausePoints: detail.pausePoints.map((point) =>
+      pausePoints: detail.pausePoints.map(({ display, ...point }) =>
         point.response ? { ...point, response: { ...point.response, data: undefined } } : point
       ),
     }
@@ -3791,7 +3807,7 @@ export class PauseResumeManager {
     }
   }
 
-  private static mapPausePoints(
+  static mapPausePoints(
     pausePoints: unknown,
     queuePositions?: Map<string, number | null>,
     latestEntries?: Map<string, ResumeQueueEntrySummary>
@@ -3833,14 +3849,15 @@ export class PauseResumeManager {
         resumeLinks,
         pauseKind: point.pauseKind ?? 'human',
         resumeAt: point.resumeAt,
+        ...scrubbedPauseDisplay(point),
         queuePosition,
         latestResumeEntry: latestEntry ?? null,
       }
     })
   }
 
-  private static computeQueuePositions(
-    queueEntries: ResumeQueueEntrySummary[]
+  static computeQueuePositions(
+    queueEntries: Pick<ResumeQueueEntrySummary, 'contextId' | 'status' | 'queuedAt'>[]
   ): Map<string, number | null> {
     const pendingEntries = queueEntries
       .filter((entry) => entry.status === 'pending')
diff --git a/apps/sim/lib/workflows/executor/pause-persistence.integration.ts b/apps/sim/lib/workflows/executor/pause-persistence.integration.ts
index 90abb753337..df03f717ae8 100644
--- a/apps/sim/lib/workflows/executor/pause-persistence.integration.ts
+++ b/apps/sim/lib/workflows/executor/pause-persistence.integration.ts
@@ -1,12 +1,14 @@
 /**
  * Pause publication against real PostgreSQL: a paused run becomes resumable only once its
- * log has been finalized out of `running`, so an immediate resume finds a claimable log.
+ * log has been finalized out of `running`, so an immediate resume finds a claimable log; and
+ * the pause points a run detail reads back from what was published.
  */
 import { db } from '@sim/db'
 import {
   pausedExecutions,
   user,
   workflow,
+  workflowDeploymentVersion,
   workflowExecutionLogs,
   workflowExecutionSnapshots,
   workspace,
@@ -22,9 +24,16 @@ import {
 } from '@/lib/billing/core/attribution'
 import { LoggingSession } from '@/lib/logs/execution/logging-session'
 import type { WorkflowState } from '@/lib/logs/types'
+import {
+  getWorkflowExecutionStatus,
+  readPausedRunPoints,
+} from '@/lib/workflows/executor/execution-status'
 import { PauseResumeManager } from '@/lib/workflows/executor/human-in-the-loop-manager'
 import { handlePostExecutionPauseState } from '@/lib/workflows/executor/pause-persistence'
-import type { ExecutionResult } from '@/executor/types'
+import { capturePauseDisplay } from '@/executor/human-in-the-loop/utils'
+import type { ExecutionResult, PausePoint } from '@/executor/types'
+import { ResolvedSecretTraceRegistry } from '@/executor/utils/resolved-secret-trace-registry'
+import { buildBranchNodeId } from '@/executor/utils/subflow-node-id-codec'
 
 const ids = {
   owner: `pause-publish-owner-${generateId()}`,
@@ -51,25 +60,29 @@ const workflowState: WorkflowState = {
   parallels: {},
 }
 
+/** A marker only the execution snapshot carries, so a read that leaks the snapshot shows it. */
+const SNAPSHOT_SENTINEL = `snapshot-only-${generateId()}`
+
 function pausedResult(
   executionId: string,
-  billingAttribution: BillingAttributionSnapshot
+  billingAttribution: BillingAttributionSnapshot,
+  pausePoints: PausePoint[] = [
+    {
+      contextId: CONTEXT_ID,
+      blockId: CONTEXT_ID,
+      response: {},
+      registeredAt: new Date().toISOString(),
+      resumeStatus: 'paused',
+      snapshotReady: true,
+      pauseKind: 'human',
+    },
+  ]
 ): ExecutionResult {
   return {
     success: true,
     output: {},
     status: 'paused',
-    pausePoints: [
-      {
-        contextId: CONTEXT_ID,
-        blockId: CONTEXT_ID,
-        response: {},
-        registeredAt: new Date().toISOString(),
-        resumeStatus: 'paused',
-        snapshotReady: true,
-        pauseKind: 'human',
-      },
-    ],
+    pausePoints,
     snapshotSeed: {
       snapshot: JSON.stringify({
         metadata: {
@@ -79,6 +92,7 @@ function pausedResult(
           userId: ids.owner,
           billingAttribution,
         },
+        state: { sentinel: SNAPSHOT_SENTINEL },
       }),
       triggerIds: [],
     },
@@ -86,7 +100,7 @@ function pausedResult(
 }
 
 /** Starts a run whose log is `running`, as the core leaves it when execution returns. */
-async function startRun() {
+async function startRun(pausePoints?: PausePoint[]) {
   const executionId = generateId()
   const billingAttribution = await resolveBillingAttribution({
     actorUserId: ids.owner,
@@ -99,7 +113,11 @@ async function startRun() {
     billingAttribution,
     workflowState,
   })
-  return { executionId, loggingSession, result: pausedResult(executionId, billingAttribution) }
+  return {
+    executionId,
+    loggingSession,
+    result: pausedResult(executionId, billingAttribution, pausePoints),
+  }
 }
 
 async function logStatus(executionId: string) {
@@ -110,11 +128,11 @@ async function logStatus(executionId: string) {
   return row?.status
 }
 
-function resume(executionId: string) {
+function resume(executionId: string, contextId = CONTEXT_ID) {
   return PauseResumeManager.enqueueOrStartResume({
     executionId,
     workflowId: ids.workflow,
-    contextId: CONTEXT_ID,
+    contextId,
     resumeInput: {},
     userId: ids.owner,
   })
@@ -151,6 +169,9 @@ afterAll(async () => {
   // Deleting a paused execution cascades to its resume queue entries.
   await db.delete(pausedExecutions).where(eq(pausedExecutions.workflowId, ids.workflow))
   await db.delete(workflowExecutionLogs).where(eq(workflowExecutionLogs.workflowId, ids.workflow))
+  await db
+    .delete(workflowDeploymentVersion)
+    .where(eq(workflowDeploymentVersion.workflowId, ids.workflow))
   await db
     .delete(workflowExecutionSnapshots)
     .where(eq(workflowExecutionSnapshots.workflowId, ids.workflow))
@@ -215,3 +236,261 @@ describe('handlePostExecutionPauseState', () => {
     })
   })
 })
+
+const SECRET = `resolved-secret-${generateId()}`
+const PARALLEL_ID = 'review-parallel'
+const BRANCH_IDS = [0, 1].map((index) => buildBranchNodeId(CONTEXT_ID, index))
+
+/** A run registry that has resolved {@link SECRET} as `{{API_KEY}}`, as a block input would. */
+function registryWithResolvedSecret() {
+  const registry = new ResolvedSecretTraceRegistry([
+    { name: 'API_KEY', plaintext: SECRET, encryptedValue: 'ciphertext' },
+  ])
+  registry.recordResolved('API_KEY', SECRET)
+  return registry
+}
+
+/** The pause a human-in-the-loop block in a parallel branch records, with a secret in its content. */
+function humanBranchPoint(
+  branchIndex: number,
+  registry: ResolvedSecretTraceRegistry | undefined
+): PausePoint {
+  const contextId = BRANCH_IDS[branchIndex]
+  const response = {
+    data: {
+      operation: 'human',
+      responseStructure: [{ name: 'summary', type: 'string', value: `Token is ${SECRET}` }],
+      inputFormat: [{ id: 'f1', name: 'approved', type: 'boolean', required: true, value: SECRET }],
+      submission: null,
+      _resume: { apiUrl: 'https://resume.invalid/api', uiUrl: 'https://resume.invalid/ui' },
+    },
+    status: 200,
+    headers: { 'X-Pause-Header': SECRET },
+  }
+  return {
+    ...capturePauseDisplay({ pauseKind: 'human', response }, registry),
+    contextId,
+    blockId: contextId,
+    response,
+    registeredAt: new Date(Date.UTC(2026, 0, 1, 0, 0, branchIndex)).toISOString(),
+    resumeStatus: 'paused',
+    snapshotReady: true,
+    parallelScope: { parallelId: PARALLEL_ID, branchIndex, branchTotal: 2 },
+    pauseKind: 'human',
+  }
+}
+
+/** Publishes a paused run the way the core does once its log is finalized. */
+async function publishPausedRun(points: PausePoint[]) {
+  const { executionId, loggingSession, result } = await startRun(points)
+  loggingSession.setPostExecutionPromise(loggingSession.safeCompleteWithPause({ traceSpans: [] }))
+  await handlePostExecutionPauseState({
+    result,
+    workflowId: ids.workflow,
+    executionId,
+    loggingSession,
+  })
+  return executionId
+}
+
+async function storedPausePoints(executionId: string): Promise<Record<string, PausePoint>> {
+  const [row] = await db
+    .select({ pausePoints: pausedExecutions.pausePoints })
+    .from(pausedExecutions)
+    .where(eq(pausedExecutions.executionId, executionId))
+  return row.pausePoints as Record<string, PausePoint>
+}
+
+describe('readPausedRunPoints', () => {
+  it('lists every parallel branch with its scope, queue position, and deployed block name', async () => {
+    const registry = registryWithResolvedSecret()
+    const executionId = await publishPausedRun([
+      humanBranchPoint(0, registry),
+      humanBranchPoint(1, registry),
+    ])
+    const versionId = generateId()
+    await db.insert(workflowDeploymentVersion).values({
+      id: versionId,
+      workflowId: ids.workflow,
+      version: 1,
+      state: { blocks: { [CONTEXT_ID]: { id: CONTEXT_ID, name: 'Approval' } } },
+      isActive: false,
+    })
+    await db
+      .update(workflowExecutionLogs)
+      .set({ deploymentVersionId: versionId })
+      .where(eq(workflowExecutionLogs.executionId, executionId))
+
+    await expect(resume(executionId, BRANCH_IDS[0])).resolves.toMatchObject({
+      status: 'starting',
+    })
+    await expect(resume(executionId, BRANCH_IDS[1])).resolves.toMatchObject({
+      status: 'queued',
+      queuePosition: 1,
+    })
+
+    const points = await readPausedRunPoints({ workflowId: ids.workflow, executionId })
+
+    expect(points?.map(({ display, inputFields, ...point }) => point)).toEqual(
+      [0, 1].map((branchIndex) => ({
+        contextId: BRANCH_IDS[branchIndex],
+        blockId: CONTEXT_ID,
+        blockName: 'Approval',
+        kind: 'human',
+        status: branchIndex === 0 ? 'resuming' : 'queued',
+        registeredAt: new Date(Date.UTC(2026, 0, 1, 0, 0, branchIndex)).toISOString(),
+        resumeAt: null,
+        parallel: { parallelId: PARALLEL_ID, branchIndex, branchTotal: 2 },
+        loop: null,
+        queuePosition: branchIndex === 0 ? null : 1,
+      }))
+    )
+  })
+
+  it('stores and returns pause content with resolved secrets redacted and control data withheld', async () => {
+    const executionId = await publishPausedRun([humanBranchPoint(0, registryWithResolvedSecret())])
+
+    const stored = await storedPausePoints(executionId)
+    expect(stored[BRANCH_IDS[0]]).toMatchObject({ displayScrubbed: true })
+    expect(JSON.stringify(stored[BRANCH_IDS[0]].display)).not.toContain(SECRET)
+
+    const [point] = (await readPausedRunPoints({ workflowId: ids.workflow, executionId })) ?? []
+    expect(point.display).toEqual({
+      responseStructure: [{ name: 'summary', type: 'string', value: 'Token is {{API_KEY}}' }],
+    })
+    expect(point.inputFields).toEqual([
+      { name: 'approved', label: 'approved', type: 'boolean', required: true },
+    ])
+    const body = JSON.stringify(point)
+    for (const withheld of [SECRET, SNAPSHOT_SENTINEL, 'resume.invalid', 'X-Pause-Header']) {
+      expect(body).not.toContain(withheld)
+    }
+  })
+
+  it('withholds content it cannot prove free of secrets', async () => {
+    const executionId = await publishPausedRun([humanBranchPoint(0, undefined)])
+
+    const [point] = (await readPausedRunPoints({ workflowId: ids.workflow, executionId })) ?? []
+    expect(point).toMatchObject({ display: null, inputFields: null, blockName: null })
+  })
+
+  it('exposes no content from a point persisted before pause content was scrubbed', async () => {
+    const { displayScrubbed, display, inputFields, ...legacy } = humanBranchPoint(0, undefined)
+    legacy.response.data.responseStructure[0].value = SECRET
+    const executionId = await publishPausedRun([legacy])
+
+    expect((await storedPausePoints(executionId))[BRANCH_IDS[0]]).not.toHaveProperty(
+      'displayScrubbed'
+    )
+    const [point] = (await readPausedRunPoints({ workflowId: ids.workflow, executionId })) ?? []
+    expect(point).toMatchObject({ display: null, inputFields: null })
+    expect(JSON.stringify(point)).not.toContain(SECRET)
+  })
+
+  it('keeps the input fields when the reviewer content is too large to capture', async () => {
+    const point = humanBranchPoint(0, registryWithResolvedSecret())
+    point.response.data.responseStructure[0].value = 'x'.repeat(70 * 1024)
+    const executionId = await publishPausedRun([
+      { ...point, ...capturePauseDisplay(point, registryWithResolvedSecret()) },
+    ])
+
+    const [read] = (await readPausedRunPoints({ workflowId: ids.workflow, executionId })) ?? []
+    expect(read).toMatchObject({
+      display: null,
+      inputFields: [{ name: 'approved', label: 'approved', type: 'boolean', required: true }],
+    })
+  })
+
+  it('lists a point recorded without a registration time instead of failing the run', async () => {
+    const { registeredAt, ...unregistered } = humanBranchPoint(0, registryWithResolvedSecret())
+    const executionId = await publishPausedRun([unregistered as PausePoint])
+
+    const [read] = (await readPausedRunPoints({ workflowId: ids.workflow, executionId })) ?? []
+    expect(read).toMatchObject({ contextId: BRANCH_IDS[0], registeredAt: null })
+  })
+
+  it('reports the parent run version for a resume still starting or queued', async () => {
+    const registry = registryWithResolvedSecret()
+    const executionId = await publishPausedRun([
+      humanBranchPoint(0, registry),
+      humanBranchPoint(1, registry),
+    ])
+    const versionId = generateId()
+    await db.insert(workflowDeploymentVersion).values({
+      id: versionId,
+      workflowId: ids.workflow,
+      version: 2,
+      state: { blocks: {} },
+      isActive: false,
+    })
+    await db
+      .update(workflowExecutionLogs)
+      .set({ deploymentVersionId: versionId })
+      .where(eq(workflowExecutionLogs.executionId, executionId))
+
+    const starting = await resume(executionId, BRANCH_IDS[0])
+    const queued = await resume(executionId, BRANCH_IDS[1])
+    expect([starting.status, queued.status]).toEqual(['starting', 'queued'])
+
+    for (const attempt of [starting, queued]) {
+      const status = await getWorkflowExecutionStatus({
+        workflowId: ids.workflow,
+        executionId: attempt.resumeExecutionId,
+        includeOutput: false,
+        selectedOutputs: [],
+        workspaceId: ids.workspace,
+        viewerUserId: ids.owner,
+      })
+      expect(status).toMatchObject({ status: 'queued', deploymentVersion: 2 })
+    }
+  })
+
+  it('returns the selected point display once, not again in every listed point', async () => {
+    const registry = registryWithResolvedSecret()
+    const executionId = await publishPausedRun([
+      humanBranchPoint(0, registry),
+      humanBranchPoint(1, registry),
+    ])
+
+    const detail = await PauseResumeManager.getPauseContextDetail({
+      workflowId: ids.workflow,
+      executionId,
+      contextId: BRANCH_IDS[0],
+    })
+
+    expect(detail?.pausePoint.display).toEqual({
+      responseStructure: [{ name: 'summary', type: 'string', value: 'Token is {{API_KEY}}' }],
+    })
+    expect(detail?.execution.pausePoints).toHaveLength(2)
+    for (const point of detail?.execution.pausePoints ?? []) {
+      expect(point).not.toHaveProperty('display')
+    }
+  })
+
+  it('reports a time pause with its resume time and no input fields', async () => {
+    const resumeAt = new Date(Date.now() + 60_000).toISOString()
+    const executionId = await publishPausedRun([
+      {
+        ...capturePauseDisplay({ pauseKind: 'time', response: {} }, registryWithResolvedSecret()),
+        contextId: 'wait',
+        blockId: 'wait',
+        response: {},
+        registeredAt: new Date().toISOString(),
+        resumeStatus: 'paused',
+        snapshotReady: true,
+        pauseKind: 'time',
+        resumeAt,
+      },
+    ])
+
+    const [point] = (await readPausedRunPoints({ workflowId: ids.workflow, executionId })) ?? []
+    expect(point).toMatchObject({
+      kind: 'time',
+      resumeAt,
+      inputFields: null,
+      display: null,
+      parallel: null,
+      loop: null,
+    })
+  })
+})
diff --git a/apps/sim/lib/workflows/persistence/utils.ts b/apps/sim/lib/workflows/persistence/utils.ts
index 86e0862dfab..7aa642764d9 100644
--- a/apps/sim/lib/workflows/persistence/utils.ts
+++ b/apps/sim/lib/workflows/persistence/utils.ts
@@ -10,6 +10,7 @@ import { createLogger } from '@sim/logger'
 import { getActiveWorkflowContext } from '@sim/platform-authz/workflow'
 import { getErrorMessage } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
+import { toRecord } from '@sim/utils/object'
 import {
   loadWorkflowFromNormalizedTablesRaw,
   persistMigratedBlocks,
@@ -97,6 +98,24 @@ export interface WorkflowDeploymentVersionResponse {
 export interface DeployedWorkflowData extends NormalizedWorkflowData {
   deploymentVersionId: string
   variables?: Record<string, unknown>
+  /**
+   * Whether the version's snapshot recorded its variables. Versions deployed before
+   * deployments snapshotted variables did not, and `variables` defaults to `{}` for them.
+   */
+  variablesSnapshotted?: boolean
+}
+
+/**
+ * The variables a queued deployed run (async API, schedule, webhook) executes with: the
+ * deployed version's own, or the workflow's saved variables for a version deployed before
+ * deployments snapshotted them, which is what those runs have always used for such a version.
+ */
+export function resolveDeployedRunVariables(
+  deployedState: DeployedWorkflowData,
+  savedVariables: unknown
+): Record<string, unknown> {
+  if (deployedState.variablesSnapshotted) return deployedState.variables ?? {}
+  return toRecord(savedVariables)
 }
 
 /**
@@ -268,6 +287,7 @@ export async function materializeDeploymentState(
     loops: state.loops || {},
     parallels: state.parallels || {},
     variables: state.variables || {},
+    variablesSnapshotted: state.variables != null,
     isFromNormalizedTables: false,
     deploymentVersionId: version.id,
   }
@@ -1122,6 +1142,28 @@ export async function getWorkflowDeploymentVersion(
   return row ?? null
 }
 
+/**
+ * Resolves a deployment version number to its row id without reading the
+ * version's state. Returns null when the workflow has no such version.
+ */
+export async function getWorkflowDeploymentVersionId(
+  workflowId: string,
+  version: number
+): Promise<string | null> {
+  const [row] = await db
+    .select({ id: workflowDeploymentVersion.id })
+    .from(workflowDeploymentVersion)
+    .where(
+      and(
+        eq(workflowDeploymentVersion.workflowId, workflowId),
+        eq(workflowDeploymentVersion.version, version)
+      )
+    )
+    .limit(1)
+
+  return row?.id ?? null
+}
+
 export interface ListWorkflowVersionsOptions {
   /** Caps the rows read. Omitted reads every version. */
   limit?: number
diff --git a/apps/sim/package.json b/apps/sim/package.json
index 925c7360ffd..42cc8cf119e 100644
--- a/apps/sim/package.json
+++ b/apps/sim/package.json
@@ -31,6 +31,7 @@
     "test:landing-seo:e2e": "bun --no-env-file scripts/test-landing-seo-e2e.ts",
     "test:workflow-version-compare:e2e": "bun --no-env-file scripts/test-workflow-version-compare-e2e.ts",
     "test:workflow-stop-after:e2e": "bun --no-env-file scripts/test-workflow-stop-after-e2e.ts",
+    "test:workflow-pinned-execute:e2e": "bun --no-env-file scripts/test-workflow-pinned-execute-e2e.ts",
     "test:desktop-inbox:e2e": "bun --no-env-file scripts/test-desktop-inbox-e2e.ts",
     "test:cli-run-latency:e2e": "bun --no-env-file scripts/test-cli-run-latency-e2e.ts",
     "test:watch": "vitest",
diff --git a/apps/sim/scripts/test-workflow-pinned-execute-e2e.ts b/apps/sim/scripts/test-workflow-pinned-execute-e2e.ts
new file mode 100644
index 00000000000..9d00c1266f8
--- /dev/null
+++ b/apps/sim/scripts/test-workflow-pinned-execute-e2e.ts
@@ -0,0 +1,530 @@
+import assert from 'node:assert/strict'
+import { writeFile } from 'node:fs/promises'
+import { assertDisposableTestDatabaseUrl } from '@sim/db/testing/test-infrastructure'
+import { createLogger } from '@sim/logger'
+import { sha256Hex } from '@sim/security/hash'
+import { getErrorMessage } from '@sim/utils/errors'
+import { sleep } from '@sim/utils/helpers'
+import { generateId } from '@sim/utils/id'
+import { isRecordLike } from '@sim/utils/object'
+import { truncate } from '@sim/utils/string'
+import postgres from 'postgres'
+import {
+  type V2ExecuteWorkflowBody,
+  type V2ResumeWorkflowBody,
+  v2ExecuteWorkflowDataSchema,
+  v2WorkflowRunStatusSchema,
+} from '@/lib/api/contracts/v2/workflows'
+import { readResponseTextWithLimit } from '@/lib/core/utils/stream-limits'
+
+/**
+ * Exercises `run: { source: 'deployment', version }` on the v2 execute route
+ * against a running local Next app and a disposable database.
+ *
+ * Every fixture workflow is deployed twice: version 1 and the active version 2
+ * differ only in which block runs, so a run's block outputs and its recorded
+ * `deployment_version_id` show which graph executed. Before the executor honored
+ * the pin, a pinned run loaded version 1 for its variables and still executed
+ * version 2 — the pinned checks fail on that code.
+ *
+ * Run against a dev stack with `bun run test:workflow-pinned-execute:e2e`, setting
+ * `PINNED_EXECUTE_E2E_BASE_URL` (the loopback app origin), `PINNED_EXECUTE_E2E_DATABASE_URL`
+ * (the disposable database that app uses), and `PINNED_EXECUTE_E2E_REPORT_PATH`.
+ */
+const logger = createLogger('WorkflowPinnedExecuteE2E')
+const MAX_RESPONSE_BYTES = 2 * 1024 * 1024
+/** The first request to each route cold-compiles it under `next dev`. */
+const ROUTE_COMPILE_TIMEOUT_MS = 300_000
+const REQUEST_TIMEOUT_MS = 60_000
+const POLL_ATTEMPTS = 300
+const POLL_INTERVAL_MS = 200
+const startedAt = new Date().toISOString()
+
+function requiredEnvironment(name: string): string {
+  const value = process.env[name]
+  assert(value, `${name} must be explicitly provided`)
+  return value
+}
+
+const baseUrl = new URL(requiredEnvironment('PINNED_EXECUTE_E2E_BASE_URL'))
+const databaseUrl = assertDisposableTestDatabaseUrl(
+  requiredEnvironment('PINNED_EXECUTE_E2E_DATABASE_URL')
+)
+const reportPath = requiredEnvironment('PINNED_EXECUTE_E2E_REPORT_PATH')
+assert(new Set(['localhost', '127.0.0.1', '[::1]']).has(baseUrl.hostname), 'Use a loopback app')
+assert.equal(baseUrl.protocol, 'http:', 'Use a local HTTP app')
+assert(!baseUrl.username && !baseUrl.password, 'App URL cannot contain credentials')
+assert.equal(baseUrl.pathname, '/', 'App URL must be an origin')
+assert(!baseUrl.search && !baseUrl.hash, 'App URL cannot contain a query or fragment')
+
+const sql = postgres(databaseUrl.toString(), { max: 2 })
+const ownerId = generateId()
+const readerId = generateId()
+const workspaceId = generateId()
+const ownerKey = `sk-sim-fixture-${generateId()}`
+const readerKey = `sk-sim-fixture-${generateId()}`
+const checks: { name: string; status: 'passed' | 'failed'; durationMs: number; error?: string }[] =
+  []
+/** `status` is null when the request ended without a complete response. */
+const requests: { method: string; path: string; status: number | null; durationMs: number }[] = []
+
+interface VersionedFixture {
+  workflowId: string
+  start: string
+  /** Block only version 1 contains, keyed by the name selectors use. */
+  one: { id: string; name: string }
+  /** Block only version 2 (the active one) contains. */
+  two: { id: string; name: string }
+  /** Human pause both versions place before their own block, when present. */
+  approval?: string
+  versionIds: [string, string]
+}
+
+function versionedFixture(withApproval: boolean): VersionedFixture {
+  return {
+    workflowId: generateId(),
+    start: generateId(),
+    one: { id: generateId(), name: 'VersionOne' },
+    two: { id: generateId(), name: 'VersionTwo' },
+    ...(withApproval ? { approval: generateId() } : {}),
+    versionIds: [generateId(), generateId()],
+  }
+}
+
+const plain = versionedFixture(false)
+const paused = versionedFixture(true)
+const publicFixture = versionedFixture(false)
+
+function failureMessage(error: unknown): string {
+  let message = getErrorMessage(error)
+  for (const secret of [ownerKey, readerKey]) message = message.replaceAll(secret, '[redacted]')
+  return truncate(message, 2000)
+}
+
+async function check(name: string, run: () => Promise<void>) {
+  const started = performance.now()
+  try {
+    await run()
+    checks.push({ name, status: 'passed', durationMs: Math.round(performance.now() - started) })
+    logger.info('Check passed', { name })
+  } catch (error) {
+    checks.push({
+      name,
+      status: 'failed',
+      durationMs: Math.round(performance.now() - started),
+      error: failureMessage(error),
+    })
+    throw error
+  }
+}
+
+function record(value: unknown): Record<string, unknown> {
+  assert(isRecordLike(value), 'Expected a JSON object')
+  return value
+}
+
+function block(id: string, type: string, name: string, index: number, subBlocks = {}) {
+  return {
+    id,
+    type,
+    name,
+    enabled: true,
+    position: { x: index * 300, y: 0 },
+    outputs: {},
+    subBlocks,
+  }
+}
+
+const waitSubBlocks = {
+  timeValue: { id: 'timeValue', type: 'short-input', value: '0.1' },
+  timeUnit: { id: 'timeUnit', type: 'dropdown', value: 'seconds' },
+  async: { id: 'async', type: 'switch', value: false },
+}
+
+/** The approval asks for one required field, which the run detail lists for the pause. */
+const approvalSubBlocks = {
+  inputFormat: {
+    id: 'inputFormat',
+    type: 'input-format',
+    value: [{ id: 'approved', name: 'approved', type: 'boolean', required: true }],
+  },
+}
+
+/** The deployed graph of one version: Start → [Approval →] the version's own block. */
+function deployedState(fixture: VersionedFixture, version: 1 | 2) {
+  const own = version === 1 ? fixture.one : fixture.two
+  const chain = [
+    block(fixture.start, 'start_trigger', 'Start', 0, {
+      inputFormat: { id: 'inputFormat', type: 'input-format', value: [] },
+    }),
+    ...(fixture.approval
+      ? [block(fixture.approval, 'human_in_the_loop', 'Approval', 1, approvalSubBlocks)]
+      : []),
+    block(own.id, 'wait', own.name, 2, waitSubBlocks),
+  ]
+  return {
+    blocks: Object.fromEntries(chain.map((entry) => [entry.id, entry])),
+    edges: chain.slice(1).map((target, index) => ({
+      id: generateId(),
+      source: chain[index].id,
+      target: target.id,
+      sourceHandle: 'source',
+      targetHandle: 'target',
+    })),
+    loops: {},
+    parallels: {},
+    variables: {},
+    lastSaved: 0,
+  }
+}
+
+async function seedFixture(
+  tx: postgres.TransactionSql,
+  fixture: VersionedFixture,
+  isPublicApi: boolean
+) {
+  await tx`insert into workflow (id, user_id, workspace_id, name, last_synced, created_at, updated_at, is_deployed, deployed_at, is_public_api)
+    values (${fixture.workflowId}, ${ownerId}, ${workspaceId}, ${`Pinned execute fixture ${fixture.workflowId}`}, now(), now(), now(), true, now(), ${isPublicApi})`
+  for (const version of [1, 2] as const) {
+    await tx`insert into workflow_deployment_version (id, workflow_id, version, state, is_active, created_by)
+      values (${fixture.versionIds[version - 1]}, ${fixture.workflowId}, ${version}, ${JSON.stringify(deployedState(fixture, version))}::text::json, ${version === 2}, ${ownerId})`
+  }
+}
+
+async function seed() {
+  await sql.begin(async (tx) => {
+    for (const [id, label] of [
+      [ownerId, 'owner'],
+      [readerId, 'reader'],
+    ]) {
+      const email = `${id}@pinned-execute.test`
+      await tx`insert into "user" (id, name, email, normalized_email, email_verified, created_at, updated_at)
+        values (${id}, ${`Pinned execute ${label}`}, ${email}, ${email}, true, now(), now())`
+      await tx`insert into user_stats (id, user_id) values (${generateId()}, ${id})`
+    }
+    await tx`insert into project (id, name, owner_id)
+      values (${workspaceId}, 'Pinned execute project', ${ownerId})`
+    await tx`insert into workspace (id, project_id, name, owner_id, billed_account_user_id)
+      values (${workspaceId}, ${workspaceId}, 'Pinned execute fixture', ${ownerId}, ${ownerId})`
+    for (const [id, role] of [
+      [ownerId, 'admin'],
+      [readerId, 'read'],
+    ]) {
+      await tx`insert into permissions (id, user_id, entity_type, entity_id, permission_type)
+        values (${generateId()}, ${id}, 'workspace', ${workspaceId}, ${role})`
+    }
+    for (const [id, key] of [
+      [ownerId, ownerKey],
+      [readerId, readerKey],
+    ]) {
+      await tx`insert into api_key (id, user_id, name, key, key_hash, type)
+        values (${generateId()}, ${id}, 'Pinned execute fixture', ${key}, ${sha256Hex(key)}, 'personal')`
+    }
+    await seedFixture(tx, plain, false)
+    await seedFixture(tx, paused, false)
+    await seedFixture(tx, publicFixture, true)
+  })
+}
+
+function isTimeout(error: unknown): boolean {
+  return error instanceof DOMException && error.name === 'TimeoutError'
+}
+
+async function request(
+  method: 'GET' | 'POST',
+  path: string,
+  {
+    body,
+    key = ownerKey,
+    expectedStatus = 200,
+    timeoutMs = REQUEST_TIMEOUT_MS,
+  }: {
+    body?: V2ExecuteWorkflowBody | V2ResumeWorkflowBody | Record<string, unknown>
+    key?: string | null
+    expectedStatus?: number
+    timeoutMs?: number
+  } = {}
+): Promise<Record<string, unknown>> {
+  const url = new URL(path, baseUrl)
+  const started = performance.now()
+  const elapsed = () => Math.round(performance.now() - started)
+  let status: number | null = null
+  let text: string
+  try {
+    // boundary-raw-fetch: protocol E2E exercises a separately running local app over real HTTP
+    const response = await fetch(url, {
+      method,
+      redirect: 'error',
+      signal: AbortSignal.timeout(timeoutMs),
+      headers: {
+        accept: 'application/json',
+        'x-forwarded-for': '127.0.0.1',
+        ...(body ? { 'content-type': 'application/json' } : {}),
+        ...(key ? { 'x-api-key': key } : {}),
+      },
+      ...(body ? { body: JSON.stringify(body) } : {}),
+    })
+    text = await readResponseTextWithLimit(response, {
+      maxBytes: MAX_RESPONSE_BYTES,
+      label: 'Pinned execute E2E response',
+    })
+    status = response.status
+    assert.equal(response.headers.get('cache-control'), 'private, no-store')
+  } catch (error) {
+    const reason = isTimeout(error)
+      ? `no complete response within ${timeoutMs / 1000}s`
+      : getErrorMessage(error)
+    throw new Error(`${method} ${url.pathname} failed after ${elapsed()} ms: ${reason}`)
+  } finally {
+    requests.push({ method, path: url.pathname, status, durationMs: elapsed() })
+  }
+  assert.equal(status, expectedStatus, `${method} ${url.pathname}: ${truncate(text, 500)}`)
+  return record(JSON.parse(text))
+}
+
+function execute(fixture: VersionedFixture, body: Record<string, unknown>, options = {}) {
+  return request('POST', `/api/v2/workflows/${fixture.workflowId}/execute`, {
+    body,
+    ...options,
+  })
+}
+
+async function expectError(
+  fixture: VersionedFixture,
+  body: Record<string, unknown>,
+  expectedStatus: number,
+  code: string,
+  key: string | null = ownerKey
+) {
+  const error = record((await execute(fixture, body, { expectedStatus, key })).error)
+  assert.equal(error.code, code, JSON.stringify(error))
+}
+
+/**
+ * Selectors resolve against the graph the request loads, so each run selects only
+ * the block of the version it should execute: an unknown name is a 400 before the
+ * run. A run that loaded one version and executed the other answers without it.
+ */
+const selectOwn = (own: { name: string }) => [`${own.name}.status`]
+
+/** The version id the durable log recorded for a run. */
+async function loggedVersionId(runId: string): Promise<string | null> {
+  const [row] =
+    await sql`select deployment_version_id from workflow_execution_logs where execution_id = ${runId}`
+  assert(row, `Run ${runId} has no execution log`)
+  return row.deployment_version_id
+}
+
+async function runStatus(fixture: VersionedFixture, runId: string, query = '') {
+  return v2WorkflowRunStatusSchema.parse(
+    (
+      await request('GET', `/api/v2/workflows/${fixture.workflowId}/runs/${runId}${query}`, {
+        timeoutMs: ROUTE_COMPILE_TIMEOUT_MS,
+      })
+    ).data
+  )
+}
+
+async function waitForSettled(fixture: VersionedFixture, runId: string) {
+  for (let attempt = 0; attempt < POLL_ATTEMPTS; attempt++) {
+    const status = await runStatus(fixture, runId)
+    if (status.status !== 'queued' && status.status !== 'running') return status
+    await sleep(POLL_INTERVAL_MS)
+  }
+  throw new Error(`Run ${runId} did not settle`)
+}
+
+try {
+  await check('seed disposable workspace, deployed versions and credentials', seed)
+
+  await check('the execute route compiles and runs the active version by default', async () => {
+    const data = v2ExecuteWorkflowDataSchema.parse(
+      (
+        await execute(
+          plain,
+          { selectedOutputs: selectOwn(plain.two) },
+          { timeoutMs: ROUTE_COMPILE_TIMEOUT_MS }
+        )
+      ).data
+    )
+    assert.equal(data.status, 'completed', JSON.stringify(data.error))
+    assert.deepEqual(Object.keys(data.blockOutputs ?? {}), [`${plain.two.name}.status`])
+    assert.equal(await loggedVersionId(data.runId), plain.versionIds[1])
+  })
+
+  await check('a synchronous run pinned to version 1 executes version 1', async () => {
+    const data = v2ExecuteWorkflowDataSchema.parse(
+      (
+        await execute(plain, {
+          run: { source: 'deployment', version: 1 },
+          selectedOutputs: selectOwn(plain.one),
+        })
+      ).data
+    )
+    assert.equal(data.status, 'completed', JSON.stringify(data.error))
+    assert.deepEqual(Object.keys(data.blockOutputs ?? {}), [`${plain.one.name}.status`])
+    assert.equal(await loggedVersionId(data.runId), plain.versionIds[0])
+    const status = await runStatus(plain, data.runId)
+    assert.equal(status.version, 1)
+  })
+
+  await check('an asynchronous run pinned to version 1 executes version 1', async () => {
+    const receipt = record(
+      (
+        await execute(
+          plain,
+          { async: true, run: { source: 'deployment', version: 1 } },
+          { expectedStatus: 202 }
+        )
+      ).data
+    )
+    assert.equal(typeof receipt.runId, 'string')
+    const runId = String(receipt.runId)
+    const settled = await waitForSettled(plain, runId)
+    assert.equal(settled.status, 'completed', JSON.stringify(settled.error))
+    assert.equal(settled.version, 1)
+    assert.equal(await loggedVersionId(runId), plain.versionIds[0])
+    const withOutputs = await runStatus(
+      plain,
+      runId,
+      `?selectedOutputs=${plain.one.id}.status,${plain.two.id}.status`
+    )
+    assert.deepEqual(Object.keys(withOutputs.blockOutputs ?? {}), [`${plain.one.id}.status`])
+  })
+
+  await check('an unknown version answers 404 and starts no run', async () => {
+    const before =
+      await sql`select count(*)::int as n from workflow_execution_logs where workflow_id = ${plain.workflowId}`
+    await expectError(plain, { run: { source: 'deployment', version: 99 } }, 404, 'NOT_FOUND')
+    const after =
+      await sql`select count(*)::int as n from workflow_execution_logs where workflow_id = ${plain.workflowId}`
+    assert.equal(after[0].n, before[0].n)
+  })
+
+  await check('a malformed version answers 400', async () => {
+    for (const version of [0, -1, 1.5, '1', null]) {
+      await expectError(plain, { run: { source: 'deployment', version } }, 400, 'BAD_REQUEST')
+    }
+    await expectError(
+      plain,
+      { run: { source: 'deployment', version: 1, extra: true } },
+      400,
+      'BAD_REQUEST'
+    )
+  })
+
+  await check('a read-role member may run the active version but not pin one', async () => {
+    const data = v2ExecuteWorkflowDataSchema.parse(
+      (await execute(plain, {}, { key: readerKey })).data
+    )
+    assert.equal(data.status, 'completed')
+    const error = record(
+      (
+        await execute(
+          plain,
+          { run: { source: 'deployment', version: 1 } },
+          { key: readerKey, expectedStatus: 403 }
+        )
+      ).error
+    )
+    assert.equal(error.code, 'FORBIDDEN')
+    assert.equal(record(error.details).code, 'INSUFFICIENT_WORKSPACE_ROLE')
+  })
+
+  await check('an anonymous public-API caller cannot pin a version', async () => {
+    const data = v2ExecuteWorkflowDataSchema.parse(
+      (await execute(publicFixture, {}, { key: null })).data
+    )
+    assert.equal(data.status, 'completed')
+    await expectError(
+      publicFixture,
+      { run: { source: 'deployment', version: 1 } },
+      400,
+      'BAD_REQUEST',
+      null
+    )
+  })
+
+  await check(
+    'a pinned run that pauses lists its pause point and resumes on the pinned version',
+    async () => {
+      const data = v2ExecuteWorkflowDataSchema.parse(
+        (await execute(paused, { run: { source: 'deployment', version: 1 } })).data
+      )
+      assert.equal(data.status, 'paused', JSON.stringify(data.error))
+      assert.equal(await loggedVersionId(data.runId), paused.versionIds[0])
+      const pausedStatus = await runStatus(paused, data.runId)
+      assert.equal(pausedStatus.version, 1)
+      const contextId = pausedStatus.paused?.contextId
+      assert(contextId, 'The paused run must expose a resumable context')
+      const points = pausedStatus.paused?.points ?? []
+      assert.equal(points.length, 1)
+      assert.deepEqual(
+        {
+          contextId: points[0].contextId,
+          blockId: points[0].blockId,
+          blockName: points[0].blockName,
+          kind: points[0].kind,
+          status: points[0].status,
+          parallel: points[0].parallel,
+          loop: points[0].loop,
+        },
+        {
+          contextId,
+          blockId: paused.approval,
+          blockName: 'Approval',
+          kind: 'human',
+          status: 'paused',
+          parallel: null,
+          loop: null,
+        }
+      )
+      assert.deepEqual(points[0].inputFields, [
+        { name: 'approved', label: 'approved', type: 'boolean', required: true },
+      ])
+      const resumed = v2ExecuteWorkflowDataSchema.parse(
+        (
+          await request(
+            'POST',
+            `/api/v2/workflows/${paused.workflowId}/runs/${data.runId}/resume`,
+            {
+              body: { contextId, input: { approved: true } },
+              timeoutMs: ROUTE_COMPILE_TIMEOUT_MS,
+            }
+          )
+        ).data
+      )
+      assert.equal(resumed.status, 'completed', JSON.stringify(resumed.error))
+      const settled = await runStatus(
+        paused,
+        data.runId,
+        `?selectedOutputs=${paused.one.id}.status,${paused.two.id}.status`
+      )
+      assert.equal(settled.status, 'completed')
+      assert.equal(settled.version, 1)
+      assert.deepEqual(Object.keys(settled.blockOutputs ?? {}), [`${paused.one.id}.status`])
+    }
+  )
+} catch (error) {
+  logger.error('Pinned execute E2E failed', { error: failureMessage(error) })
+  process.exitCode = 1
+} finally {
+  try {
+    await check('remove disposable fixtures', async () => {
+      await sql.begin(async (tx) => {
+        await tx`delete from workspace where id = ${workspaceId}`
+        await tx`delete from project where id = ${workspaceId}`
+      })
+      await sql`delete from "user" where id in (${ownerId}, ${readerId})`
+    })
+  } catch (error) {
+    logger.error('Pinned execute E2E cleanup failed', { error: failureMessage(error) })
+    process.exitCode = 1
+  } finally {
+    await sql.end()
+    await writeFile(
+      reportPath,
+      `${JSON.stringify({ startedAt, finishedAt: new Date().toISOString(), status: process.exitCode ? 'failed' : 'passed', checks, requests }, null, 2)}\n`
+    )
+  }
+}
diff --git a/packages/sim-cli/src/generated/v2-api.ts b/packages/sim-cli/src/generated/v2-api.ts
index 246616ebde9..90fc3b7111f 100644
--- a/packages/sim-cli/src/generated/v2-api.ts
+++ b/packages/sim-cli/src/generated/v2-api.ts
@@ -5545,6 +5545,7 @@ export type ExecuteWorkflowBody = {
   run?:
     | {
         source: 'deployment'
+        version?: number
       }
     | {
         source: 'manual'
@@ -7867,6 +7868,38 @@ export type GetWorkflowRunQuery = {
 }
 
 type GetWorkflowRunResponseRef0 = {
+  contextId: string
+  blockId: string
+  blockName: string | null
+  kind: 'human' | 'time'
+  status: 'paused' | 'queued' | 'resuming' | 'resumed' | 'failed'
+  registeredAt: string | null
+  resumeAt: string | null
+  parallel: {
+    parallelId: string
+    branchIndex: number
+    branchTotal: number | null
+  } | null
+  loop: {
+    loopId: string
+    iteration: number
+  } | null
+  inputFields: Array<GetWorkflowRunResponseRef1> | null
+  display: unknown | null
+  queuePosition: number | null
+}
+
+type GetWorkflowRunResponseRef1 = {
+  name: string
+  label: string
+  type: string
+  description?: string
+  placeholder?: string
+  required: boolean
+  options?: Array<unknown>
+}
+
+type GetWorkflowRunResponseRef2 = {
   message: string
   code:
     | 'TIMEOUT'
@@ -7881,7 +7914,7 @@ type GetWorkflowRunResponseRef0 = {
   blockType?: string
 }
 
-type GetWorkflowRunResponseRef1 = {
+type GetWorkflowRunResponseRef3 = {
   id: string
   name: string
   size: number
@@ -7890,7 +7923,7 @@ type GetWorkflowRunResponseRef1 = {
   base64: string | null
 }
 
-type GetWorkflowRunResponseRef2 = {
+type GetWorkflowRunResponseRef4 = {
   runId: string
   workflowId: string
   status:
@@ -7906,6 +7939,7 @@ type GetWorkflowRunResponseRef2 = {
   startedAt: string | null
   endedAt: string | null
   durationMs: number | null
+  version: number | null
   paused: {
     contextId: string | null
     pausedAt: string
@@ -7915,18 +7949,19 @@ type GetWorkflowRunResponseRef2 = {
     automaticResumeWaitingReason: string | null
     pausePointCount: number
     resumedCount: number
+    points: Array<GetWorkflowRunResponseRef0>
   } | null
   cost: {
     total: number
   } | null
-  error: GetWorkflowRunResponseRef0 | null
+  error: GetWorkflowRunResponseRef2 | null
   output: unknown | null
   blockOutputs: Record<string, unknown> | null
-  files: Array<GetWorkflowRunResponseRef1> | null
+  files: Array<GetWorkflowRunResponseRef3> | null
 }
 
 export type GetWorkflowRunResponse = {
-  data: GetWorkflowRunResponseRef2
+  data: GetWorkflowRunResponseRef4
 }
 
 /** `GET /api/v2/workflows/[workflowId]/state` */
@@ -18661,7 +18696,7 @@ export const V2_OPERATIONS = {
       run: {
         kind: 'unknown',
         describe:
-          'Workflow state and entry point to execute. Omit for the active deployment. Manual execution requires OAuth or personal-key write access and supports synchronous or streamed runs only; `waitTimeoutSeconds` lets a synchronous one continue in the background.',
+          'Workflow state and entry point to execute. Omit for the active deployment; `source: "deployment"` with `version` runs that deployment version. Manual execution requires OAuth or personal-key write access and supports synchronous or streamed runs only; `waitTimeoutSeconds` lets a synchronous one continue in the background.',
       },
       async: {
         kind: 'boolean',
diff --git a/packages/testing/src/mocks/workflows-persistence-utils.mock.ts b/packages/testing/src/mocks/workflows-persistence-utils.mock.ts
index a131c1dee42..6b2e0ba74d8 100644
--- a/packages/testing/src/mocks/workflows-persistence-utils.mock.ts
+++ b/packages/testing/src/mocks/workflows-persistence-utils.mock.ts
@@ -95,6 +95,16 @@ export const workflowsPersistenceUtilsMock = {
   findPreviousDeploymentVersion: workflowsPersistenceUtilsMockFns.mockFindPreviousDeploymentVersion,
   getWorkflowDeploymentVersion: workflowsPersistenceUtilsMockFns.mockGetWorkflowDeploymentVersion,
   NoActiveDeploymentError: MockNoActiveDeploymentError,
+  /** Real behavior: a snapshot's own variables, or the saved ones for a pre-snapshot version. */
+  resolveDeployedRunVariables: (
+    deployedState: { variables?: Record<string, unknown>; variablesSnapshotted?: boolean },
+    savedVariables: unknown
+  ): Record<string, unknown> =>
+    deployedState.variablesSnapshotted
+      ? (deployedState.variables ?? {})
+      : savedVariables && typeof savedVariables === 'object' && !Array.isArray(savedVariables)
+        ? (savedVariables as Record<string, unknown>)
+        : {},
   /** Real value: the sub-block ids that hold a credential reference. */
   CREDENTIAL_SUBBLOCK_IDS: new Set([
     'credential',