diff --git a/.github/workflows/ci-browser-security.yml b/.github/workflows/ci-browser-security.yml
index 571a22bd8..916fd867c 100644
--- a/.github/workflows/ci-browser-security.yml
+++ b/.github/workflows/ci-browser-security.yml
@@ -76,7 +76,7 @@ jobs:
           done < <(find /etc/php -type d -path '*/conf.d' | sort -u)
 
       - name: Setup PHP 8.2 tooling
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml, zip, gd, apcu
diff --git a/.github/workflows/ci-database-compatibility.yml b/.github/workflows/ci-database-compatibility.yml
index f5c7dd091..6f6ca9d07 100644
--- a/.github/workflows/ci-database-compatibility.yml
+++ b/.github/workflows/ci-database-compatibility.yml
@@ -73,7 +73,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml
diff --git a/.github/workflows/ci-deep-regression.yml b/.github/workflows/ci-deep-regression.yml
index 4de6f5232..9e02d7164 100644
--- a/.github/workflows/ci-deep-regression.yml
+++ b/.github/workflows/ci-deep-regression.yml
@@ -98,7 +98,7 @@ jobs:
           done < <(find /etc/php -type d -path '*/conf.d' | sort -u)
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, json, curl, openssl, zip, gd, intl, xml, apcu
@@ -300,7 +300,7 @@ jobs:
           [ -z "${php_module}" ] || sudo a2enmod "${php_module}"
           sudo a2dissite 000-default || true
       - name: Setup PHP and Node
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, curl, zip, gd, intl, xml
diff --git a/.github/workflows/ci-e2e.yml b/.github/workflows/ci-e2e.yml
index 7fb62bba6..e9c536bca 100644
--- a/.github/workflows/ci-e2e.yml
+++ b/.github/workflows/ci-e2e.yml
@@ -78,7 +78,7 @@ jobs:
 
       # ── PHP 8.2 CLI for Composer and tooling ────────────────────────────────
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, json, curl, openssl, zip, gd, intl, xml, apcu
diff --git a/.github/workflows/ci-quality.yml b/.github/workflows/ci-quality.yml
index f528f22d3..374b15aa8 100644
--- a/.github/workflows/ci-quality.yml
+++ b/.github/workflows/ci-quality.yml
@@ -66,7 +66,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql
@@ -385,7 +385,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: ${{ matrix.php }}
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml
diff --git a/.github/workflows/ci-real-upgrade.yml b/.github/workflows/ci-real-upgrade.yml
index d92028728..dea190655 100644
--- a/.github/workflows/ci-real-upgrade.yml
+++ b/.github/workflows/ci-real-upgrade.yml
@@ -102,7 +102,7 @@ jobs:
           done < <(find /etc/php -type d -path '*/conf.d' | sort -u)
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, mbstring, json, curl, openssl, zip, gd, intl, xml, apcu
diff --git a/.github/workflows/ci-security-supply-chain.yml b/.github/workflows/ci-security-supply-chain.yml
index bf1e5c89d..7eafc3938 100644
--- a/.github/workflows/ci-security-supply-chain.yml
+++ b/.github/workflows/ci-security-supply-chain.yml
@@ -119,7 +119,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml, zip
diff --git a/.github/workflows/ci-upgrade-smoke.yml b/.github/workflows/ci-upgrade-smoke.yml
index 1d0427f35..9ddfe81f3 100644
--- a/.github/workflows/ci-upgrade-smoke.yml
+++ b/.github/workflows/ci-upgrade-smoke.yml
@@ -57,7 +57,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, curl, zip, mbstring
diff --git a/.github/workflows/pullfrog.yml b/.github/workflows/pullfrog.yml
index dbfda92a3..1dfa89ccd 100644
--- a/.github/workflows/pullfrog.yml
+++ b/.github/workflows/pullfrog.yml
@@ -29,6 +29,15 @@ jobs:
   pullfrog:
     name: Pullfrog agent
     runs-on: ubuntu-latest
+    timeout-minutes: 45 # Two bounded attempts plus checkout and cleanup.
+    env:
+      # Whether a second subscription token is configured. Only the presence is
+      # hoisted to job level, not the token: a step-level `if:` cannot read the
+      # `secrets` context at all — GitHub refuses to parse the whole workflow
+      # with `Unrecognized named-value: 'secrets'` — while it does read `env`.
+      # The provider keys deliberately stay on the agent steps, so a token is
+      # never in the environment of the checkout or of the final `run:`.
+      HAS_OAUTH_FALLBACK: ${{ secrets.PULLFROG_OAUTH_FALLBACK != '' }}
     permissions:
       # The action mints a short-lived OIDC token to prove this run's identity
       # to Pullfrog's own token service, which is how a Router or subscription
@@ -54,6 +63,11 @@ jobs:
           # unauthenticated fetch works.
           persist-credentials: false
       - name: Run agent
+        id: agent
+        # Held back rather than fatal: a failure here is the cue for the
+        # fallback step below. The final step restores the failure when no
+        # attempt succeeded, so a genuinely broken review still reports red.
+        continue-on-error: true
         # Pinned to a commit SHA rather than the documented `@v0`, which is a
         # tag that MOVES — it has already advanced through ninety v0.1.x
         # releases. This is the one action here that runs an agent with access
@@ -65,6 +79,7 @@ jobs:
         uses: pullfrog/pullfrog@0d318bef8c7cf7ae3f193ef32b2bc74e1d94b4d1 # v0.1.90
         with:
           prompt: ${{ inputs.prompt }}
+          timeout: 20m
           # REVIEW ONLY. `push` defaults to `enabled`, which lets the agent
           # push branches and open pull requests of its own. Every commit and
           # pull request in this repository is authored by its maintainer, so
@@ -127,3 +142,48 @@ jobs:
           # both limits are required — set them to the real limits of that model
           # OPENAI_COMPATIBLE_CONTEXT: "128000"
           # OPENAI_COMPATIBLE_MAX_OUTPUT: "16384"
+
+      # The action exposes result, not a structured failure code. One retry is
+      # therefore allowed after ANY failure, not only a 429. Each attempt is
+      # capped at 20m: deterministic errors can spend the fallback quota, and
+      # a late failure after posting can repeat a review. This bounded trade-off
+      # is deliberate; a failed review must never turn into a green no-op.
+      # The workflow OAuth token leads account OAuth tokens of the same kind.
+      # Verified in runtime 0.1.97: stable subscription sorting keeps workflow
+      # entries first. This does not claim API keys outrank subscriptions.
+      # https://github.com/pullfrog/pullfrog/blob/f0684f2c9286f321085978685f6cbe91d51d4233/utils/credentialPool.ts#L175-L187
+      # A per-account rate limit is not fixed by a second expression, only by a
+      # second attempt: the first credential has to be tried and seen to fail.
+      # Preserve the primary step's provider configuration for non-Claude
+      # models and replace only its OAuth token. Keys stay scoped to the two
+      # agent steps, never checkout or final failure reporting.
+      - name: Run agent with the fallback subscription token
+        id: agent_fallback
+        if: steps.agent.outcome == 'failure' && env.HAS_OAUTH_FALLBACK == 'true'
+        uses: pullfrog/pullfrog@0d318bef8c7cf7ae3f193ef32b2bc74e1d94b4d1 # v0.1.90
+        with:
+          prompt: ${{ inputs.prompt }}
+          timeout: 20m
+          push: disabled
+          shell: restricted
+        env:
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.PULLFROG_OAUTH_FALLBACK }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          GOOGLE_GENERATIVE_AI_API_KEY:
+            ${{ secrets.GOOGLE_GENERATIVE_AI_API_KEY }}
+          GEMINI_API_KEY: ${{ secrets.GEMINI_API_KEY }}
+          XAI_API_KEY: ${{ secrets.XAI_API_KEY }}
+          DEEPSEEK_API_KEY: ${{ secrets.DEEPSEEK_API_KEY }}
+          MOONSHOT_API_KEY: ${{ secrets.MOONSHOT_API_KEY }}
+          KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
+          META_MODEL_API_KEY: ${{ secrets.META_MODEL_API_KEY }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          AI_GATEWAY_API_KEY: ${{ secrets.AI_GATEWAY_API_KEY }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+
+      - name: Fail when no attempt succeeded
+        if: steps.agent.outcome == 'failure' && steps.agent_fallback.outcome != 'success'
+        run: |
+          echo "::error::The agent failed with the primary credential, and the fallback failed too or is not configured."
+          exit 1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 299b74364..9a615e0b2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
         run: bash scripts/ci-verify-release-source.sh
 
       - name: Setup PHP 8.2
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql, mbstring, curl, intl, xml, zip, gd
diff --git a/.github/workflows/test-migrations.yml b/.github/workflows/test-migrations.yml
index 5ea1689c0..02e262490 100644
--- a/.github/workflows/test-migrations.yml
+++ b/.github/workflows/test-migrations.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           coverage: none
@@ -84,7 +84,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli
@@ -218,7 +218,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           extensions: mysqli, pdo_mysql