diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 6795d40e..3f3d6e06 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -14,59 +14,14 @@ concurrency:
 
 jobs:
   dependency-review:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          persist-credentials: false
-
-      - name: Check dependency review support
-        id: dependency_review_support
-        env:
-          GH_TOKEN: ${{ github.token }}
-          BASE_SHA: ${{ github.event.pull_request.base.sha }}
-          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-          REPOSITORY: ${{ github.repository }}
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          if [ "${{ github.event_name }}" != "pull_request" ]; then
-            echo "supported=false" >>"$GITHUB_OUTPUT"
-            echo "Dependency review only runs as a hard gate for pull_request events."
-            exit 0
-          fi
-
-          api_url="${GITHUB_API_URL:-https://api.github.com}"
-          response_file="$(mktemp)"
-          status="$(
-            curl -fsS -o "$response_file" -w '%{http_code}' \
-              -H "Accept: application/vnd.github+json" \
-              -H "Authorization: Bearer ${GH_TOKEN}" \
-              -H "X-GitHub-Api-Version: 2022-11-28" \
-              "${api_url}/repos/${REPOSITORY}/dependency-graph/compare/${BASE_SHA}...${HEAD_SHA}" \
-              || true
-          )"
-
-          if [ "$status" = "200" ]; then
-            echo "supported=true" >>"$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          if [ "$status" = "403" ] || [ "$status" = "404" ]; then
-            echo "::warning::Dependency review is unavailable for ${REPOSITORY}; skipping dependency-review hard gate."
-            echo "supported=false" >>"$GITHUB_OUTPUT"
-            exit 0
-          fi
-
-          echo "::error::Dependency review support check failed with HTTP ${status}."
-          cat "$response_file"
-          exit 1
-
-      - name: Dependency review
-        if: steps.dependency_review_support.outputs.supported == 'true'
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          fail-on-severity: moderate
-          comment-summary-in-pr: on-failure
+    uses: ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@5f8e5b2a79e709c4ab1a4179a605d34c458b13a1
+    with:
+      fail_on_severity: moderate
+      # The central workflow's default comment_summary_in_pr ("on-failure")
+      # forwards to dependency-review-action's comment-summary-in-pr, which
+      # needs pull-requests: write to post a PR comment. This caller only
+      # grants pull-requests: read, so an actual failure would try to comment
+      # without permission (CodeRabbit). No PR summary comment is needed here
+      # -- the job's own pass/fail status is the signal -- so this opts out
+      # explicitly rather than escalating to write.
+      comment_summary_in_pr: never
diff --git a/tests/config/test_strix_static_repo_adaptations.py b/tests/config/test_strix_static_repo_adaptations.py
index 5707b278..c2352078 100644
--- a/tests/config/test_strix_static_repo_adaptations.py
+++ b/tests/config/test_strix_static_repo_adaptations.py
@@ -8,6 +8,7 @@
 OSV_WORKFLOW = REPO_ROOT / ".github" / "workflows" / "osvscanner.yml"
 K8S_DEPLOYMENT = REPO_ROOT / "infra" / "k8s" / "deployment.yaml"
 K8S_SERVICE = REPO_ROOT / "infra" / "k8s" / "service.yaml"
+CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA = "5f8e5b2a79e709c4ab1a4179a605d34c458b13a1"
 
 
 def test_central_review_workflows_are_not_copied_into_this_repository() -> None:
@@ -56,11 +57,18 @@ def test_kubernetes_deployment_uses_non_root_versioned_runtime() -> None:
     assert 'targetPort: 8080' in service_source
 
 
-def test_companion_workflows_cover_named_requirements_manifests_and_full_history() -> None:
+def test_companion_workflows_pin_central_dependency_review_and_cover_osv_manifests() -> None:
     dependency_review_source = DEPENDENCY_REVIEW_WORKFLOW.read_text(encoding="utf-8")
     osv_source = OSV_WORKFLOW.read_text(encoding="utf-8")
 
-    assert "actions/dependency-review-action@" in dependency_review_source
+    expected_reusable_workflow = (
+        "ContextualWisdomLab/.github/.github/workflows/dependency-review.yml@"
+        f"{CENTRAL_DEPENDENCY_REVIEW_WORKFLOW_SHA}"
+    )
+    assert expected_reusable_workflow in dependency_review_source
+    assert "dependency-review.yml@main" not in dependency_review_source
+    assert "permissions:\n  contents: read\n  pull-requests: read" in dependency_review_source
+    assert "fail_on_severity: moderate" in dependency_review_source
     assert 'requirements(-[A-Za-z0-9._-]+)?\\.txt' in osv_source
     assert "google/osv-scanner-action" in osv_source
     assert "-r" in osv_source