diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index 6ed47ae5..16663383 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -1177,7 +1177,11 @@ jobs:
           # standards helper is not present. Preserve the canonical helper
           # before removing this sparse standards checkout.
           LOCK_SCRIPT=".standards-dupkey/scripts/update-actions-lock.sh"
-          if [ ! -f "$LOCK_SCRIPT" ] && [ -f scripts/update-actions-lock.sh ]; then
+          # Standards must exercise the helper from its own PR tree or a broken
+          # helper can never validate its fix. Consumers may not substitute a
+          # repository-local verifier: they continue to use standards@main.
+          if [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] && \
+             [ -f scripts/update-actions-lock.sh ]; then
             LOCK_SCRIPT="scripts/update-actions-lock.sh"
             echo "Using this repository's own actions-lock verifier (standards self-lint)."
           fi
diff --git a/scripts/tests/actions-lock-update-test.sh b/scripts/tests/actions-lock-update-test.sh
index 8ca997b5..debfffe7 100755
--- a/scripts/tests/actions-lock-update-test.sh
+++ b/scripts/tests/actions-lock-update-test.sh
@@ -46,6 +46,10 @@ if [ "${2:-}" = "--verify-local" ]; then
       printf '%s\n' 'not valid JSON'
       exit 0
       ;;
+    valid-with-warning)
+      printf '%s\n' '{"valid":true,"findings":[{"workflow":".github/workflows/ci.yml","category":"sha-as-ref","severity":"warning","dependency":"actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1"}]}'
+      exit 1
+      ;;
     *)
       printf '%s\n' '{"valid":true,"findings":[]}'
       exit
@@ -96,6 +100,10 @@ cmp -s "$WORK/ci.before-verify" .github/workflows/ci.yml
 cmp -s "$WORK/lock.before-verify" .github/workflows/actions.lock
 echo "PASS: Actions lock verification restores tool-authored workflow edits"
 
+FAKE_VERIFY_FINDING=valid-with-warning GH_BIN="$WORK/bin/fake-gh" \
+  bash "$UPDATE" --verify-local .github/workflows >/dev/null
+echo "PASS: valid lock with advisory warning is accepted"
+
 cat > .github/workflows/reusable.yml <<'EOF'
 # SPDX-License-Identifier: MPL-2.0
 name: Reusable caller
diff --git a/scripts/update-actions-lock.sh b/scripts/update-actions-lock.sh
index ed9bd1ea..b8889c4e 100755
--- a/scripts/update-actions-lock.sh
+++ b/scripts/update-actions-lock.sh
@@ -71,7 +71,12 @@ verify_lock_coverage() {
     [[ "$status" -ne 0 ]] && return "$status"
     return 1
   fi
-  if printf '%s' "$result" | jq -e '.valid == true and (.findings | length == 0)' >/dev/null; then
+  # The verifier may exit non-zero while returning a valid lock plus advisory
+  # findings (for example, sha-as-ref traceability warnings). Once the output
+  # shape is established, its structured `valid` verdict is authoritative;
+  # warnings must remain visible without turning a valid lock into a failure.
+  if printf '%s' "$result" | jq -e '.valid == true' >/dev/null; then
+    printf '%s\n' "$result"
     return 0
   fi