diff --git a/.github/workflows/native-policy.yml b/.github/workflows/native-policy.yml
index 82613fd..a781af4 100644
--- a/.github/workflows/native-policy.yml
+++ b/.github/workflows/native-policy.yml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: durable-workflow/.github
-          ref: b7da972634348e9bb27ff3653c383e93965ce043
+          ref: d4770e6555fdb59b044f2e5919e95a24c0a25073
           path: .native-policy-control
           persist-credentials: false
       - name: Set up the policy interpreter
diff --git a/tests/test_native_policy_workflow.py b/tests/test_native_policy_workflow.py
index 4b7e8cc..93c5d48 100644
--- a/tests/test_native_policy_workflow.py
+++ b/tests/test_native_policy_workflow.py
@@ -24,7 +24,7 @@ def test_only_central_pinned_code_is_checked_out_without_persisted_credentials(s
         self.assertEqual(1, len(checkouts))
         settings = checkouts[0]["with"]
         self.assertEqual("durable-workflow/.github", settings["repository"])
-        self.assertRegex(settings["ref"], r"^[0-9a-f]{40}$")
+        self.assertEqual("d4770e6555fdb59b044f2e5919e95a24c0a25073", settings["ref"])
         self.assertIs(False, settings["persist-credentials"])
         self.assertEqual(".native-policy-control", settings["path"])