diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 1ad5cab..c4fc618 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -85,6 +85,27 @@ updates:
       # forms of the dependency name.
       - dependency-name: "Comfy-Org/github-workflows*"
 
+      # Hold `create-github-app-token` at v1.x in the cross-repo bumpers.
+      #
+      # The v1.12.0 -> v3.2.0 jump in the 2026-07-30 major group (#95) broke the
+      # `owner:`-without-`repositories:` token: every bump-*-callers.yml run since
+      # has 403'd with "Resource not accessible by integration" on `tree create`
+      # for every caller repo, silently stranding every consumer on a stale pin.
+      # Verified against one repo across the boundary: cloud-code-bot[bot] wrote
+      # Comfy-Org/cloud at 23:03 on v1.12.0 and 403'd on the same repo, same token
+      # config, on v3.2.0. Neither the v2.0.0 nor the v3.0.0 release notes document
+      # a scoping change, so this is pinned by evidence, not by changelog.
+      #
+      # Scoped to majors only: v1.x patches still arrive. Lifting this needs a
+      # cross-repo write proven on a real caller, not a green unit-test run —
+      # nothing in CI exercises the cross-repo path.
+      #
+      # NOTE: only the six bump-*-callers.yml workflows are held back. The
+      # current-repo minters (groom.yml, cursor-review.yml, pr-size.yml, ...) do
+      # not set `owner:`, are scoped to the running repo, and stay on v3.x.
+      - dependency-name: "actions/create-github-app-token"
+        update-types: ["version-update:semver-major"]
+
   # Dependency-free today, but declared so the day a module is added it is
   # watched rather than silently rotting — the same failure mode this file
   # exists to fix.
diff --git a/.github/workflows/bump-agents-md-callers.yml b/.github/workflows/bump-agents-md-callers.yml
index 7f95a5c..6a3df08 100644
--- a/.github/workflows/bump-agents-md-callers.yml
+++ b/.github/workflows/bump-agents-md-callers.yml
@@ -71,7 +71,7 @@ jobs:
           persist-credentials: false
 
       - name: Generate Cloud Code Bot token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
         id: token
         with:
           app-id: ${{ vars.APP_ID }}
diff --git a/.github/workflows/bump-assign-reviewers-callers.yml b/.github/workflows/bump-assign-reviewers-callers.yml
index 725be24..1ef7906 100644
--- a/.github/workflows/bump-assign-reviewers-callers.yml
+++ b/.github/workflows/bump-assign-reviewers-callers.yml
@@ -76,7 +76,7 @@ jobs:
           persist-credentials: false
 
       - name: Generate Cloud Code Bot token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
         id: token
         with:
           app-id: ${{ vars.APP_ID }}
diff --git a/.github/workflows/bump-auto-label-callers.yml b/.github/workflows/bump-auto-label-callers.yml
index e2d0bc3..b7d9bbb 100644
--- a/.github/workflows/bump-auto-label-callers.yml
+++ b/.github/workflows/bump-auto-label-callers.yml
@@ -102,7 +102,7 @@ jobs:
           persist-credentials: false
 
       - name: Generate Cloud Code Bot token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
         id: token
         with:
           app-id: ${{ vars.APP_ID }}
diff --git a/.github/workflows/bump-cursor-review-callers.yml b/.github/workflows/bump-cursor-review-callers.yml
index 2b43c4c..151b19b 100644
--- a/.github/workflows/bump-cursor-review-callers.yml
+++ b/.github/workflows/bump-cursor-review-callers.yml
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Generate Cloud Code Bot token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
         id: token
         with:
           app-id: ${{ vars.APP_ID }}
diff --git a/.github/workflows/bump-groom-callers.yml b/.github/workflows/bump-groom-callers.yml
index 442a5e0..0f8e371 100644
--- a/.github/workflows/bump-groom-callers.yml
+++ b/.github/workflows/bump-groom-callers.yml
@@ -82,7 +82,7 @@ jobs:
           persist-credentials: false
 
       - name: Generate Cloud Code Bot token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
         id: token
         with:
           app-id: ${{ vars.APP_ID }}
diff --git a/.github/workflows/bump-pr-size-callers.yml b/.github/workflows/bump-pr-size-callers.yml
index f5bd2ec..e9eda92 100644
--- a/.github/workflows/bump-pr-size-callers.yml
+++ b/.github/workflows/bump-pr-size-callers.yml
@@ -75,7 +75,7 @@ jobs:
           persist-credentials: false
 
       - name: Generate Cloud Code Bot token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0 — pinned: see dependabot.yml ignore (v2+ breaks cross-repo `owner:` token scoping)
         id: token
         with:
           app-id: ${{ vars.APP_ID }}