diff --git a/.github/workflows/dev-lead-reusable.yml b/.github/workflows/dev-lead-reusable.yml
index 8df23e6ef..040ea9b9d 100644
--- a/.github/workflows/dev-lead-reusable.yml
+++ b/.github/workflows/dev-lead-reusable.yml
@@ -257,13 +257,44 @@ jobs:
         with:
           token: ${{ secrets.GH_PAT_DON_PETRY_WRITER || secrets.GH_PAT_DON_PETRY || secrets.GH_PAT_WORKFLOWS || github.token }}
 
+      - name: Validate dev-lead ref input
+        id: agent-ref
+        shell: bash
+        env:
+          AGENT_REF: ${{ inputs.agent_ref }}
+        run: |
+          ref="$AGENT_REF"
+          if [ -z "$ref" ]; then
+            ref="main"
+          fi
+
+          # Block untrusted PR refs and unsafe ref formats.
+          if [[ "$ref" =~ ^refs/pull/ ]]; then
+            echo "::error::inputs.agent_ref must not be a pull-request ref: $ref"
+            exit 1
+          fi
+          if [[ "$ref" =~ ^[0-9a-fA-F]{40}$ ]]; then
+            echo "::error::inputs.agent_ref must not be a raw commit SHA: $ref"
+            exit 1
+          fi
+          if [[ "$ref" == *".."* || "$ref" == *":"* || "$ref" =~ [[:space:]] ]]; then
+            echo "::error::inputs.agent_ref contains unsafe characters: $ref"
+            exit 1
+          fi
+          if [[ ! "$ref" =~ ^[A-Za-z0-9._/-]+$ ]]; then
+            echo "::error::inputs.agent_ref contains invalid characters: $ref"
+            exit 1
+          fi
+
+          echo "ref=$ref" >> "$GITHUB_OUTPUT"
+
       - name: Checkout dev-lead scripts
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: combsmith/.github-private
           # Pinned channel (e.g. dev-lead/stable) when a trigger stub passes it;
           # defaults to "main" → unchanged behaviour (#535/#506).
-          ref: ${{ inputs.agent_ref }}
+          ref: ${{ steps.agent-ref.outputs.ref }}
           path: .dev-lead
           # Cross-repo callers: github.token cannot read a private org repo — ensure
           # GH_PAT_WORKFLOWS is set as an org or repo secret in the calling repo.