diff --git a/packages/bridge/tests/auto-approve-workflow.test.js b/packages/bridge/tests/auto-approve-workflow.test.js
index bbb069b..c3f04b0 100644
--- a/packages/bridge/tests/auto-approve-workflow.test.js
+++ b/packages/bridge/tests/auto-approve-workflow.test.js
@@ -1,6 +1,6 @@
 // Static assertions for .github/workflows/auto-approve.yml. The
 // caller is thin by design (triggers + pin to the reusable pr-approve
-// gate in devin-powerups), so these tests pin the v1.9 caller
+// gate in devin-powerups), so these tests pin the v1.12 caller
 // contract — the gate version, the pull_request_review_comment
 // trigger that re-evaluates the gate on fix-commit replies, and the
 // scoped job permissions. Text assertions are deliberate — the repo
@@ -14,12 +14,12 @@ import { join } from 'node:path';
 const root = fileURLToPath(new URL('../../../', import.meta.url));
 const wf = (name) => readFileSync(join(root, '.github', 'workflows', name), 'utf8');
 
-test('auto-approve: gate pin is exactly v1.9', () => {
+test('auto-approve: gate pin is exactly v1.12', () => {
   const y = wf('auto-approve.yml');
   assert.match(
     y,
-    /uses: Icaro0310\/devin-powerups\/\.github\/workflows\/pr-approve\.yml@v1\.9/,
-    'v1.9 fixes the self-cancel (successful approval no longer renders as a failed check) and adds fresh-head recheck + paginated dedup; a silent downgrade must fail here',
+    /uses: Icaro0310\/devin-powerups\/\.github\/workflows\/pr-approve\.yml@v1\.12/,
+    'v1.12 carries the v1.9 self-cancel fix plus the private-repo gate path (judge verdict required before approve); a silent downgrade must fail here',
   );
 });