diff --git a/.github/workflows/sync-upstream.yml b/.github/workflows/sync-upstream.yml
index cfe923f..094e751 100644
--- a/.github/workflows/sync-upstream.yml
+++ b/.github/workflows/sync-upstream.yml
@@ -42,10 +42,10 @@ jobs:
     permissions:
       contents: read
       issues: write
-    uses: ichava/icon-sets-sync/.github/workflows/sync-pack.yml@5fa93a687c120644f75d072a9cdd83833b9f3d80 # main 2026-11-04
+    uses: ichava/icon-sets-sync/.github/workflows/sync-pack.yml@06b17d7e08b3ff6505e0224610770adf8689dafe # main 2026-11-04
     with:
       pack: ${{ github.event.repository.name }}
-      toolkit-ref: 5fa93a687c120644f75d072a9cdd83833b9f3d80
+      toolkit-ref: 06b17d7e08b3ff6505e0224610770adf8689dafe
       refresh-app-client-id: ${{ vars.REFRESH_APP_CLIENT_ID }}
       force: ${{ inputs.force == true }}
     secrets:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 916245a..a35ee00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,10 @@ All notable changes to `ichava/icon-sets-bootstrap` follow [Keep a Changelog](ht
 
 ## [Unreleased]
 
+### Changed
+
+- **The upstream sync runs icon-sets-sync `06b17d7`** (icon-sets-sync#88), up from `5fa93a6`, which adds this pack's recipe, the `split-variants` and `exclude` transforms, and the `licence_sha256` pin on the upstream licence text. The `uses:` pin and `toolkit-ref` move together; the reusable workflow's inputs did not change between the two commits, so the caller's `with:` block is untouched.
+
 ## [0.1.0] - TBD
 
 First release of `ichava/icon-sets-bootstrap`.