diff --git a/.github/workflows/agent-coding.yml b/.github/workflows/agent-coding.yml
index 9d9a1cc..f327bea 100644
--- a/.github/workflows/agent-coding.yml
+++ b/.github/workflows/agent-coding.yml
@@ -55,6 +55,7 @@ jobs:
         env:
           CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
           REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           ISSUE_TITLE: ${{ github.event.issue.title }}
           ISSUE_BODY: ${{ github.event.issue.body }}
           ISSUE_URL: ${{ github.event.issue.html_url }}
@@ -75,9 +76,10 @@ jobs:
           PAYLOAD=$(jq -n \
             --arg prompt "$PROMPT" \
             --arg repo "$REPO" \
+            --arg ref "$DEFAULT_BRANCH" \
             '{
               prompt: { text: $prompt },
-              source: { repository: ("github.com/" + $repo), ref: "staging" },
+              source: { repository: ("github.com/" + $repo), ref: $ref },
               target: { autoCreatePr: true, openAsCursorGithubApp: true },
               model: "composer-2.5"
             }')
diff --git a/.github/workflows/agent-devops.yml b/.github/workflows/agent-devops.yml
index b5166ee..da54472 100644
--- a/.github/workflows/agent-devops.yml
+++ b/.github/workflows/agent-devops.yml
@@ -46,13 +46,14 @@ jobs:
     steps:
       - uses: actions/checkout@v7
         with:
-          ref: staging
+          ref: ${{ github.event.repository.default_branch }}
 
       - name: Trigger Cursor agent
         id: trigger
         env:
           CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
           REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
           PR_TITLE: ${{ github.event.pull_request.title }}
           PR_URL: ${{ github.event.pull_request.html_url }}
           PR_BASE: ${{ github.event.pull_request.base.ref }}
@@ -73,9 +74,10 @@ jobs:
           PAYLOAD=$(jq -n \
             --arg prompt "$PROMPT" \
             --arg repo "$REPO" \
+            --arg ref "$DEFAULT_BRANCH" \
             '{
               prompt: { text: $prompt },
-              source: { repository: ("github.com/" + $repo), ref: "staging" },
+              source: { repository: ("github.com/" + $repo), ref: $ref },
               target: { autoCreatePr: false, openAsCursorGithubApp: true },
               model: "composer-2.5"
             }')
diff --git a/.github/workflows/agent-security.yml b/.github/workflows/agent-security.yml
index 9e8b6ae..34003c6 100644
--- a/.github/workflows/agent-security.yml
+++ b/.github/workflows/agent-security.yml
@@ -2,15 +2,18 @@ name: Security Agent
 
 # Triggers Cursor's Security Cloud Agent via API in two modes:
 #   1. PR mode — Dependabot/dep-labeled PR → workflow waits + posts report
-#   2. Cron mode — weekly Mondays 06:00 UTC, sandbox creates fix PRs/issues
+#   2. Cron mode — weekly audit, sandbox creates fix PRs/issues
 # (Cursor sandbox can create new PRs/issues but cannot comment on existing
 #  PRs, so PR-mode requires the workflow to post the report itself.)
+#
+# The weekly run is NOT self-scheduled here — that would fire on every managed
+# repo at the same instant and trip Cursor's concurrent-agent limit. Instead
+# the template's weekly-security-dispatch.yml triggers this via workflow_dispatch,
+# staggered and throttled under the limit. (cron-mode still runs on dispatch.)
 
 on:
   pull_request:
     types: [opened, synchronize, labeled]
-  schedule:
-    - cron: "0 6 * * 1"
   workflow_dispatch:
 
 jobs:
@@ -159,6 +162,7 @@ jobs:
         env:
           CURSOR_API_KEY: ${{ secrets.CURSOR_API_KEY }}
           REPO: ${{ github.repository }}
+          DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         run: |
           set -euo pipefail
           PROMPT=$(jq -Rs \
@@ -176,9 +180,10 @@ jobs:
           PAYLOAD=$(jq -n \
             --arg prompt "$PROMPT" \
             --arg repo "$REPO" \
+            --arg ref "$DEFAULT_BRANCH" \
             '{
               prompt: { text: $prompt },
-              source: { repository: ("github.com/" + $repo), ref: "main" },
+              source: { repository: ("github.com/" + $repo), ref: $ref },
               target: { autoCreatePr: true, openAsCursorGithubApp: true },
               model: "composer-2.5"
             }')