diff --git a/.github/workflows/smart-discovery-capture-build.yml b/.github/workflows/smart-discovery-capture-build.yml
index d4294532b..7c1b4a685 100644
--- a/.github/workflows/smart-discovery-capture-build.yml
+++ b/.github/workflows/smart-discovery-capture-build.yml
@@ -39,11 +39,21 @@ jobs:
     name: Build smart-discovery portable field capture
     runs-on: windows-latest
     steps:
-      - name: Checkout ARSAS test branch
+      - name: Checkout exact ARSAS candidate
+        uses: actions/checkout@v7
+        with:
+          path: ArIED61850Tester
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Verify exact candidate revision
         shell: powershell
         run: |
-          $ref = if ($env:GITHUB_HEAD_REF) { $env:GITHUB_HEAD_REF } else { $env:GITHUB_REF_NAME }
-          git clone --quiet --depth 1 --branch $ref "https://github.com/$env:GITHUB_REPOSITORY.git" ArIED61850Tester
+          $actual = (git -C .\ArIED61850Tester rev-parse HEAD).Trim().ToLowerInvariant()
+          $expected = $env:GITHUB_SHA.Trim().ToLowerInvariant()
+          if ($actual -ne $expected) {
+            throw "ARSAS source revision mismatch. Expected $expected, checked out $actual."
+          }
 
       - name: Resolve and validate engine pin
         shell: powershell
diff --git a/.github/workflows/smart-discovery-golden-budget-lock.yml b/.github/workflows/smart-discovery-golden-budget-lock.yml
index d6d29f123..15a1aa4cb 100644
--- a/.github/workflows/smart-discovery-golden-budget-lock.yml
+++ b/.github/workflows/smart-discovery-golden-budget-lock.yml
@@ -39,11 +39,21 @@ jobs:
     name: Verify P0-5e evidence-derived hard budget
     runs-on: windows-latest
     steps:
-      - name: Checkout ARSAS branch
+      - name: Checkout exact ARSAS candidate
+        uses: actions/checkout@v7
+        with:
+          path: ArIED61850Tester
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Verify exact candidate revision
         shell: powershell
         run: |
-          $ref = if ($env:GITHUB_HEAD_REF) { $env:GITHUB_HEAD_REF } else { $env:GITHUB_REF_NAME }
-          git clone --quiet --depth 1 --branch $ref "https://github.com/$env:GITHUB_REPOSITORY.git" ArIED61850Tester
+          $actual = (git -C .\ArIED61850Tester rev-parse HEAD).Trim().ToLowerInvariant()
+          $expected = $env:GITHUB_SHA.Trim().ToLowerInvariant()
+          if ($actual -ne $expected) {
+            throw "ARSAS source revision mismatch. Expected $expected, checked out $actual."
+          }
 
       - name: Validate P0-5e production target remains evidence-gated
         shell: powershell
diff --git a/.github/workflows/smart-discovery-golden-provenance.yml b/.github/workflows/smart-discovery-golden-provenance.yml
index 333ad7ac0..01dd2bc0c 100644
--- a/.github/workflows/smart-discovery-golden-provenance.yml
+++ b/.github/workflows/smart-discovery-golden-provenance.yml
@@ -39,11 +39,21 @@ jobs:
     name: Verify P0-5e capture build and target provenance
     runs-on: windows-latest
     steps:
-      - name: Checkout ARSAS branch
+      - name: Checkout exact ARSAS candidate
+        uses: actions/checkout@v7
+        with:
+          path: ArIED61850Tester
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Verify exact candidate revision
         shell: powershell
         run: |
-          $ref = if ($env:GITHUB_HEAD_REF) { $env:GITHUB_HEAD_REF } else { $env:GITHUB_REF_NAME }
-          git clone --quiet --depth 1 --branch $ref "https://github.com/$env:GITHUB_REPOSITORY.git" ArIED61850Tester
+          $actual = (git -C .\ArIED61850Tester rev-parse HEAD).Trim().ToLowerInvariant()
+          $expected = $env:GITHUB_SHA.Trim().ToLowerInvariant()
+          if ($actual -ne $expected) {
+            throw "ARSAS source revision mismatch. Expected $expected, checked out $actual."
+          }
 
       - name: Execute P0-5e provenance fixtures
         shell: powershell
diff --git a/.github/workflows/smart-discovery-repeat-run-stability.yml b/.github/workflows/smart-discovery-repeat-run-stability.yml
index 7d522c487..48ad5a0ce 100644
--- a/.github/workflows/smart-discovery-repeat-run-stability.yml
+++ b/.github/workflows/smart-discovery-repeat-run-stability.yml
@@ -39,11 +39,21 @@ jobs:
     name: Verify P0-5f repeat-run stability contract
     runs-on: windows-latest
     steps:
-      - name: Checkout ARSAS branch
+      - name: Checkout exact ARSAS candidate
+        uses: actions/checkout@v7
+        with:
+          path: ArIED61850Tester
+          fetch-depth: 1
+          persist-credentials: false
+
+      - name: Verify exact candidate revision
         shell: powershell
         run: |
-          $ref = if ($env:GITHUB_HEAD_REF) { $env:GITHUB_HEAD_REF } else { $env:GITHUB_REF_NAME }
-          git clone --quiet --depth 1 --branch $ref "https://github.com/$env:GITHUB_REPOSITORY.git" ArIED61850Tester
+          $actual = (git -C .\ArIED61850Tester rev-parse HEAD).Trim().ToLowerInvariant()
+          $expected = $env:GITHUB_SHA.Trim().ToLowerInvariant()
+          if ($actual -ne $expected) {
+            throw "ARSAS source revision mismatch. Expected $expected, checked out $actual."
+          }
 
       - name: Validate P0-5f sources
         shell: powershell