diff --git a/patterns/workflow-generation.json b/patterns/workflow-generation.json
index 329e7d8..bb5827f 100644
--- a/patterns/workflow-generation.json
+++ b/patterns/workflow-generation.json
@@ -617,7 +617,8 @@
         "- **DO NOT** approve or request changes.",
         "- **DO NOT** manufacture issues or comment on uncertain findings.",
         "- Reference affected lines and explain impact."
-      ]
+      ],
+      "min_integrity": "approved"
     },
     "daily-test-improver": {
       "icon": "check",
@@ -829,7 +830,8 @@
         "- **DO NOT** review generated files, lock files, or unchanged code.",
         "- **DO NOT** duplicate comments or manufacture findings.",
         "- **DO NOT** apply a skill outside its stated scope."
-      ]
+      ],
+      "min_integrity": "approved"
     },
     "security-scanner": {
       "icon": "shield",
diff --git a/src/js/workflow.js b/src/js/workflow.js
index 4789fbf..adb5ed8 100644
--- a/src/js/workflow.js
+++ b/src/js/workflow.js
@@ -273,6 +273,8 @@ export function generateWorkflowFile(answers, patterns) {
     if (inferred.bash) frontmatter += '  bash: true\n';
     if (inferred.githubToolsets) {
       frontmatter += `  github:\n    toolsets: [${  toolsetsFor(patterns, answers.archetype).join(', ')  }]\n`;
+      const minIntegrity = workflowDefinition(patterns, answers.archetype).min_integrity;
+      if (minIntegrity) frontmatter += `    min-integrity: ${  minIntegrity  }\n`;
     }
     extras.forEach((extra) => {
       if (extra.tool === 'cache-memory') frontmatter += '  cache-memory:\n';
diff --git a/test/workflow.test.js b/test/workflow.test.js
index 0959ef0..b043a84 100644
--- a/test/workflow.test.js
+++ b/test/workflow.test.js
@@ -307,7 +307,19 @@ describe('generateWorkflowFile', () => {
       patterns
     );
     expect(md).toContain('permissions:\n  contents: read\n  issues: read\n  pull-requests: read\n');
-    expect(md).toContain('  github:\n    toolsets: [repos, issues, pull_requests]\n');
+    expect(md).toContain('  github:\n    toolsets: [repos, issues, pull_requests]\n    min-integrity: approved\n');
+  });
+
+  it('does not add min-integrity for archetypes without untrusted external content', () => {
+    const md = generateWorkflowFile(
+      answers({
+        archetype: 'status-report',
+        triggers: ['schedule'],
+        outputs: ['create-issue']
+      }),
+      patterns
+    );
+    expect(md).not.toContain('min-integrity');
   });
 
   it('gives bash-only archetypes a minimal read permissions block', () => {