diff --git a/CHANGELOG.md b/CHANGELOG.md
index d31f4760e4..2842c276fa 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,7 +6,7 @@ Semantic Versioning where the repository publishes a release.
 
 ## [Unreleased]
 - Noema, Strix, and OpenCode review sidecars now vendor contextual-orchestrator
-  at `0adca4703df67f8f31d3ea5b04a1e07ed775dd6c` and treat every KV credential
+  at `c107e3e52371993aa9c326fcc245e01c41fc3850` and treat every KV credential
   as an independent discovery account. Same-vendor credentials no longer
   collapse into a provider family; only explicit model groups may share
   routing evidence.
diff --git a/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md b/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
index 5b4f130f3f..21b118ce90 100644
--- a/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
+++ b/docs/adr/0003-contextual-orchestrator-vendored-free-zdr.md
@@ -24,7 +24,7 @@ all five, and auto-optimize routing by cost.
 
 1. **Vendoring, pinned**: `scripts/ci/contextual_orchestrator_review_sidecar.sh`
    clones `ContextualWisdomLab/contextual-orchestrator` at an exact SHA
-   (`0adca4703df67f8f31d3ea5b04a1e07ed775dd6c` today) into `RUNNER_TEMP`. The
+   (`c107e3e52371993aa9c326fcc245e01c41fc3850` today) into `RUNNER_TEMP`. The
    source's `requirements.lock` is installed with `--require-hashes` and
    `--no-deps`, so dependency resolution cannot silently move the reviewed
    runtime.
diff --git a/scripts/ci/contextual_orchestrator_review_sidecar.sh b/scripts/ci/contextual_orchestrator_review_sidecar.sh
index 34cf89eb22..2b83c321ab 100755
--- a/scripts/ci/contextual_orchestrator_review_sidecar.sh
+++ b/scripts/ci/contextual_orchestrator_review_sidecar.sh
@@ -14,7 +14,7 @@
 # (fail-closed zero-cost) pool.
 set -euo pipefail
 
-ORCHESTRATOR_PIN_SHA="${ORCHESTRATOR_PIN_SHA:-0adca4703df67f8f31d3ea5b04a1e07ed775dd6c}"
+ORCHESTRATOR_PIN_SHA="${ORCHESTRATOR_PIN_SHA:-c107e3e52371993aa9c326fcc245e01c41fc3850}"
 ORCHESTRATOR_GIT_URL="${ORCHESTRATOR_GIT_URL:-https://github.com/ContextualWisdomLab/contextual-orchestrator.git}"
 # The Strix gate and Noema SSRF guard accept this one process-local origin.
 # Keep it fixed so an environment override cannot create an unvalidated sidecar.
diff --git a/tests/test_contextual_orchestrator_review_sidecar_contract.py b/tests/test_contextual_orchestrator_review_sidecar_contract.py
index 11807185e4..cbcf690d0b 100644
--- a/tests/test_contextual_orchestrator_review_sidecar_contract.py
+++ b/tests/test_contextual_orchestrator_review_sidecar_contract.py
@@ -40,7 +40,7 @@
 )
 
 GATEWAY_MODEL = "contextual-orchestrator/orchestrator/free"
-ORCH_PIN_SHA = "0adca4703df67f8f31d3ea5b04a1e07ed775dd6c"
+ORCH_PIN_SHA = "c107e3e52371993aa9c326fcc245e01c41fc3850"
 
 
 def _read(path: Path) -> str: