diff --git a/.github/workflows/dev-deploy.yml b/.github/workflows/dev-deploy.yml
index 95361a6..30203b1 100644
--- a/.github/workflows/dev-deploy.yml
+++ b/.github/workflows/dev-deploy.yml
@@ -275,6 +275,10 @@ jobs:
           deploy githubStatsGo GithubStatsGo \
             --trigger-http --allow-unauthenticated --memory=256Mi --timeout=60s \
             --set-env-vars="GITHUB_CLIENT_ID=$SANPAI_GH_CLIENT_ID,GITHUB_CLIENT_SECRET=$SANPAI_GH_CLIENT_SECRET"
+          # ピン留め保存(GitHubでリポジトリを検証するため同じ資格情報を使う)
+          deploy pinnedReposGo PinnedReposGo \
+            --trigger-http --allow-unauthenticated --memory=256Mi --timeout=30s \
+            --set-env-vars="GITHUB_CLIENT_ID=$SANPAI_GH_CLIENT_ID,GITHUB_CLIENT_SECRET=$SANPAI_GH_CLIENT_SECRET"
           deploy omikujiGo OmikujiGo \
             --trigger-http --allow-unauthenticated --memory=256Mi --timeout=30s \
             --set-env-vars="OMIKUJI_COOLDOWN_SECONDS=60,KUDA_BASE_URL=https://kuda.kojiran.workers.dev"
diff --git a/.github/workflows/prod-deploy.yml b/.github/workflows/prod-deploy.yml
index c2b02e0..2acb9ea 100644
--- a/.github/workflows/prod-deploy.yml
+++ b/.github/workflows/prod-deploy.yml
@@ -223,6 +223,10 @@ jobs:
           deploy githubStatsGo GithubStatsGo \
             --trigger-http --allow-unauthenticated --memory=256Mi --timeout=60s \
             --set-env-vars="GITHUB_CLIENT_ID=$SANPAI_GH_CLIENT_ID,GITHUB_CLIENT_SECRET=$SANPAI_GH_CLIENT_SECRET"
+          # ピン留め保存(GitHubでリポジトリを検証するため同じ資格情報を使う)
+          deploy pinnedReposGo PinnedReposGo \
+            --trigger-http --allow-unauthenticated --memory=256Mi --timeout=30s \
+            --set-env-vars="GITHUB_CLIENT_ID=$SANPAI_GH_CLIENT_ID,GITHUB_CLIENT_SECRET=$SANPAI_GH_CLIENT_SECRET"
           deploy omikujiGo OmikujiGo \
             --trigger-http --allow-unauthenticated --memory=256Mi --timeout=30s \
             --set-env-vars="OMIKUJI_COOLDOWN_SECONDS=28800,KUDA_BASE_URL=https://kuda.kojiran.workers.dev"
diff --git a/app/functions-go/github_stats.go b/app/functions-go/github_stats.go
index 93b779f..0ca9be7 100644
--- a/app/functions-go/github_stats.go
+++ b/app/functions-go/github_stats.go
@@ -81,7 +81,9 @@ type githubStatsData struct {
 
 type githubStatsResponse struct {
 	githubStatsData
-	FetchedAt string `json:"fetched_at"`
+	// TopRepos の選出元: "pinned"(本人指定) or "stars"(スター上位の自動選出)
+	TopReposSource string `json:"top_repos_source"`
+	FetchedAt      string `json:"fetched_at"`
 }
 
 func githubStatsHandler(w http.ResponseWriter, r *http.Request) {
@@ -123,9 +125,14 @@ func runGithubStats(ctx context.Context, w http.ResponseWriter, client *firestor
 		return nil
 	}
 
+	// 本人がピン留めしていれば top_repos をそれで置き換える(pinnedReposGoが
+	// GitHub検証済みの実データを保存している)。github_stats キャッシュとは
+	// 独立に毎リクエスト反映されるので、ピン変更に6hのTTLは掛からない。
+	pinned := readPinnedRepos(userDoc)
+
 	cached, fetchedAt := readGithubStatsCache(userDoc)
 	if cached != nil && now.Sub(fetchedAt) < githubStatsTTL {
-		writeGithubStatsResponse(w, *cached, fetchedAt)
+		writeGithubStatsResponse(w, *cached, pinned, fetchedAt)
 		return nil
 	}
 
@@ -134,7 +141,7 @@ func runGithubStats(ctx context.Context, w http.ResponseWriter, client *firestor
 		// GitHub側の失敗。古いキャッシュがあればそれで凌ぐ(可用性優先)。
 		if cached != nil {
 			log.Printf("githubStats: fetch failed, serving stale cache: %v", err)
-			writeGithubStatsResponse(w, *cached, fetchedAt)
+			writeGithubStatsResponse(w, *cached, pinned, fetchedAt)
 			return nil
 		}
 		log.Printf("githubStats: fetch failed with no cache: %v", err)
@@ -149,19 +156,42 @@ func runGithubStats(ctx context.Context, w http.ResponseWriter, client *firestor
 		return err
 	}
 
-	writeGithubStatsResponse(w, stats, now)
+	writeGithubStatsResponse(w, stats, pinned, now)
 	return nil
 }
 
-func writeGithubStatsResponse(w http.ResponseWriter, stats githubStatsData, fetchedAt time.Time) {
+func writeGithubStatsResponse(w http.ResponseWriter, stats githubStatsData, pinned []githubTopRepo, fetchedAt time.Time) {
+	source := "stars"
+	if len(pinned) > 0 {
+		stats.TopRepos = pinned
+		source = "pinned"
+	}
 	// 公開データ・userでキー分離。Firestore側で6hキャッシュするためCDNも長めで良い。
 	w.Header().Set("Cache-Control", "public, max-age=300, s-maxage=3600, stale-while-revalidate=86400")
 	writeJSON(w, http.StatusOK, githubStatsResponse{
 		githubStatsData: stats,
+		TopReposSource:  source,
 		FetchedAt:       fetchedAt.UTC().Format(time.RFC3339),
 	})
 }
 
+// readPinnedRepos はユーザードキュメントの pinned_repos を読む(無ければnil)。
+func readPinnedRepos(userDoc *firestore.DocumentSnapshot) []githubTopRepo {
+	raw, err := userDoc.DataAt("pinned_repos")
+	if err != nil || raw == nil {
+		return nil
+	}
+	b, err := json.Marshal(raw)
+	if err != nil {
+		return nil
+	}
+	var pinned []githubTopRepo
+	if err := json.Unmarshal(b, &pinned); err != nil {
+		return nil
+	}
+	return pinned
+}
+
 func readGithubStatsCache(userDoc *firestore.DocumentSnapshot) (*githubStatsData, time.Time) {
 	v, err := userDoc.DataAt("github_stats_fetched_at")
 	if err != nil {
diff --git a/app/functions-go/pinned_repos.go b/app/functions-go/pinned_repos.go
new file mode 100644
index 0000000..f16501e
--- /dev/null
+++ b/app/functions-go/pinned_repos.go
@@ -0,0 +1,215 @@
+// ピン留めリポジトリ(代表リポジトリの本人指定)保存エンドポイント。
+//
+// 公開プロフィールの「GitHubの実績」内の代表リポジトリは、通常はスター上位の
+// 自動選出(github_stats.go)だが、本人がリポジトリを指定(ピン留め)できる。
+//
+//	POST {github_id, repos: ["repo-name", ...]}(Bearer必須、最大6件)
+//
+// セキュリティ上のポイント:
+//   - 書き込み系設定のため、IDトークンのUIDとユーザードキュメントの
+//     auth_user_uid(registerGoがログイン毎に維持)の一致を必須にする
+//     (他人のピンを書き換えられない)。
+//   - 保存するメタデータ(スター数等)はクライアント申告ではなく、サーバーが
+//     GitHub API(GET /repos/{owner}/{repo})で検証・取得した実値
+//     (プロフィール上のスター数の自称詐称を防ぐ)。owner不一致は拒否。
+package gofunctions
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net/http"
+	"net/url"
+	"regexp"
+	"time"
+
+	"cloud.google.com/go/firestore"
+	"github.com/GoogleCloudPlatform/functions-framework-go/functions"
+	"google.golang.org/grpc/codes"
+	grpcstatus "google.golang.org/grpc/status"
+)
+
+func init() {
+	functions.HTTP("PinnedReposGo", pinnedReposHandler)
+}
+
+// maxPinnedRepos はピン留めの上限。GitHub本家のピン留め(6件)に合わせる。
+const maxPinnedRepos = 6
+
+// githubRepoNameRe はGitHubのリポジトリ名として妥当な形式
+// (英数・ハイフン・アンダースコア・ドット、100文字以内)。
+var githubRepoNameRe = regexp.MustCompile(`^[A-Za-z0-9._-]{1,100}$`)
+
+type pinnedReposRequestBody struct {
+	GithubID string   `json:"github_id"`
+	Repos    []string `json:"repos"`
+}
+
+func pinnedReposHandler(w http.ResponseWriter, r *http.Request) {
+	setCORSHeaders(w, r)
+	if r.Method == http.MethodOptions {
+		w.Header().Set("Access-Control-Allow-Methods", "POST,OPTIONS")
+		w.Header().Set("Access-Control-Allow-Headers", "Content-Type,Authorization")
+		w.WriteHeader(http.StatusNoContent)
+		return
+	}
+	if r.Method != http.MethodPost {
+		writeJSON(w, http.StatusOK, map[string]string{"status": "failed"})
+		return
+	}
+
+	ctx := r.Context()
+
+	var body pinnedReposRequestBody
+	if err := decodeJSONBody(r, &body); err != nil {
+		log.Printf("pinnedRepos: decodeJSONBody error: %v", err)
+		writeJSON(w, http.StatusBadRequest, map[string]string{"status": "failed"})
+		return
+	}
+	if body.GithubID == "" {
+		writeJSON(w, http.StatusOK, map[string]string{"status": "failed parameter"})
+		return
+	}
+
+	token, ok := extractBearerToken(r)
+	if !ok {
+		writeJSON(w, http.StatusUnauthorized, map[string]string{"status": "authorization missing."})
+		return
+	}
+	authClient, err := getFirebaseAuthClient(ctx)
+	if err != nil {
+		log.Printf("pinnedRepos: getFirebaseAuthClient error: %v", err)
+		writeError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+	decoded, err := authClient.VerifyIDToken(ctx, token)
+	if err != nil {
+		log.Printf("pinnedRepos: VerifyIDToken error: %v", err)
+		writeJSON(w, http.StatusForbidden, map[string]string{"status": "authorization missing."})
+		return
+	}
+
+	client, err := getFirestoreClient(ctx)
+	if err != nil {
+		log.Printf("pinnedRepos: getFirestoreClient error: %v", err)
+		writeError(w, http.StatusInternalServerError, "internal error")
+		return
+	}
+
+	if err := runPinnedRepos(ctx, w, client, body, decoded.UID); err != nil {
+		log.Printf("pinnedRepos: %v", err)
+		writeError(w, http.StatusInternalServerError, "internal error")
+	}
+}
+
+func runPinnedRepos(ctx context.Context, w http.ResponseWriter, client *firestore.Client, body pinnedReposRequestBody, authUID string) error {
+	userRef := client.Collection("users").Doc(body.GithubID)
+	userSnap, err := userRef.Get(ctx)
+	if err != nil {
+		if grpcstatus.Code(err) == codes.NotFound {
+			writeJSON(w, http.StatusOK, map[string]string{"status": "failed", "message": "not registered"})
+			return nil
+		}
+		return err
+	}
+
+	// 本人確認: トークンUIDとドキュメントの auth_user_uid の一致を必須にする。
+	// auth_user_uid 未設定(registerGo を通っていない旧セッション)は再ログインを促す。
+	var userData struct {
+		AuthUserUID string `firestore:"auth_user_uid"`
+		ScreenName  string `firestore:"screen_name"`
+	}
+	if err := userSnap.DataTo(&userData); err != nil {
+		return err
+	}
+	if userData.AuthUserUID == "" || userData.AuthUserUID != authUID {
+		writeJSON(w, http.StatusForbidden, map[string]string{"status": "forbidden"})
+		return nil
+	}
+
+	names, err := normalizePinnedRepoNames(body.Repos)
+	if err != nil {
+		writeJSON(w, http.StatusOK, map[string]interface{}{"status": "failed", "message": err.Error()})
+		return nil
+	}
+
+	// 各リポジトリをGitHubで検証し、実データでメタデータを組み立てる。
+	pinned := make([]githubTopRepo, 0, len(names))
+	for _, name := range names {
+		repo, err := fetchGithubRepo(ctx, userData.ScreenName, name)
+		if err != nil {
+			log.Printf("pinnedRepos: verify %s/%s failed: %v", userData.ScreenName, name, err)
+			writeJSON(w, http.StatusOK, map[string]interface{}{
+				"status":  "failed",
+				"message": fmt.Sprintf("repository not found: %s", name),
+			})
+			return nil
+		}
+		pinned = append(pinned, repo)
+	}
+
+	if _, err := userRef.Update(ctx, []firestore.Update{
+		{Path: "pinned_repos", Value: pinned},
+		{Path: "pinned_repos_updated_at", Value: time.Now()},
+	}); err != nil {
+		return err
+	}
+
+	writeJSON(w, http.StatusOK, map[string]interface{}{
+		"status":       "success",
+		"pinned_repos": pinned,
+	})
+	return nil
+}
+
+// normalizePinnedRepoNames は名前の形式チェック・重複除去・件数制限を行う(純関数)。
+func normalizePinnedRepoNames(repos []string) ([]string, error) {
+	seen := map[string]bool{}
+	names := make([]string, 0, len(repos))
+	for _, name := range repos {
+		if !githubRepoNameRe.MatchString(name) {
+			return nil, fmt.Errorf("invalid repository name")
+		}
+		if seen[name] {
+			continue
+		}
+		seen[name] = true
+		names = append(names, name)
+	}
+	if len(names) > maxPinnedRepos {
+		return nil, fmt.Errorf("too many repositories (max %d)", maxPinnedRepos)
+	}
+	return names, nil
+}
+
+// fetchGithubRepo は GET /repos/{owner}/{repo} で1件検証・取得する。
+// owner がログイン本人でない場合(リダイレクト等で他人のリポジトリに解決された
+// 場合を含む)はエラー。
+func fetchGithubRepo(ctx context.Context, owner, name string) (githubTopRepo, error) {
+	var repo struct {
+		Name        string `json:"name"`
+		HTMLURL     string `json:"html_url"`
+		Description string `json:"description"`
+		Stars       int64  `json:"stargazers_count"`
+		Forks       int64  `json:"forks_count"`
+		Language    string `json:"language"`
+		Owner       struct {
+			Login string `json:"login"`
+		} `json:"owner"`
+	}
+	reqURL := fmt.Sprintf("%s/repos/%s/%s", githubAPIBaseURL, url.PathEscape(owner), url.PathEscape(name))
+	if err := githubGetJSON(ctx, reqURL, &repo); err != nil {
+		return githubTopRepo{}, err
+	}
+	if repo.Owner.Login != owner {
+		return githubTopRepo{}, fmt.Errorf("owner mismatch: %s", repo.Owner.Login)
+	}
+	return githubTopRepo{
+		Name:        repo.Name,
+		HTMLURL:     repo.HTMLURL,
+		Description: repo.Description,
+		Stars:       repo.Stars,
+		Forks:       repo.Forks,
+		Language:    repo.Language,
+	}, nil
+}
diff --git a/app/functions-go/pinned_repos_test.go b/app/functions-go/pinned_repos_test.go
new file mode 100644
index 0000000..963f183
--- /dev/null
+++ b/app/functions-go/pinned_repos_test.go
@@ -0,0 +1,220 @@
+package gofunctions
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+	"time"
+
+	"cloud.google.com/go/firestore"
+)
+
+func TestNormalizePinnedRepoNames(t *testing.T) {
+	// 正常系: 重複除去・順序保持
+	names, err := normalizePinnedRepoNames([]string{"repo-a", "repo.b", "repo_a", "repo-a"})
+	if err != nil || len(names) != 3 || names[0] != "repo-a" || names[2] != "repo_a" {
+		t.Errorf("normalize = %v, %v", names, err)
+	}
+
+	// 形式違反
+	for _, bad := range []string{"", "has space", "own/er", "日本語", "a<script>"} {
+		if _, err := normalizePinnedRepoNames([]string{bad}); err == nil {
+			t.Errorf("name %q should be rejected", bad)
+		}
+	}
+
+	// 上限超過(7件)
+	many := make([]string, 7)
+	for i := range many {
+		many[i] = fmt.Sprintf("repo-%d", i)
+	}
+	if _, err := normalizePinnedRepoNames(many); err == nil {
+		t.Error("7 repos should exceed the limit")
+	}
+
+	// 空 = ピン解除は許可
+	if names, err := normalizePinnedRepoNames(nil); err != nil || len(names) != 0 {
+		t.Errorf("empty should be allowed: %v %v", names, err)
+	}
+}
+
+// モックGitHub: /repos/{owner}/{repo} を返す(存在するのは owner=pin-tester の repo-a / repo-b)。
+func mockGithubForPins(t *testing.T) {
+	t.Helper()
+	mux := http.NewServeMux()
+	mux.HandleFunc("/repos/pin-tester/repo-a", func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `{"name":"repo-a","html_url":"https://github.com/pin-tester/repo-a","description":"desc A","stargazers_count":12,"forks_count":3,"language":"Go","owner":{"login":"pin-tester"}}`)
+	})
+	mux.HandleFunc("/repos/pin-tester/repo-b", func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `{"name":"repo-b","html_url":"https://github.com/pin-tester/repo-b","description":"","stargazers_count":0,"forks_count":0,"language":"Vue","owner":{"login":"pin-tester"}}`)
+	})
+	// 他人のリポジトリに解決されるケース(移管など)
+	mux.HandleFunc("/repos/pin-tester/moved", func(w http.ResponseWriter, r *http.Request) {
+		fmt.Fprint(w, `{"name":"moved","owner":{"login":"someone-else"}}`)
+	})
+	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		w.WriteHeader(http.StatusNotFound)
+	})
+	srv := httptest.NewServer(mux)
+	orig := githubAPIBaseURL
+	githubAPIBaseURL = srv.URL
+	t.Cleanup(func() {
+		githubAPIBaseURL = orig
+		srv.Close()
+	})
+}
+
+func TestPinnedRepos_SaveAndReflect(t *testing.T) {
+	client := emulatorClient(t)
+	mockGithubForPins(t)
+	ctx := context.Background()
+
+	uid := "pinned-repos-test-user-1"
+	userRef := client.Collection("users").Doc(uid)
+	if _, err := userRef.Set(ctx, map[string]interface{}{
+		"screen_name":   "pin-tester",
+		"auth_user_uid": "auth-uid-1",
+	}); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	t.Cleanup(func() { userRef.Delete(context.Background()) })
+
+	// 1) 正常保存(順序保持)
+	rec := httptest.NewRecorder()
+	if err := runPinnedRepos(ctx, rec, client, pinnedReposRequestBody{
+		GithubID: uid, Repos: []string{"repo-b", "repo-a"},
+	}, "auth-uid-1"); err != nil {
+		t.Fatalf("runPinnedRepos: %v", err)
+	}
+	var resp struct {
+		Status      string          `json:"status"`
+		PinnedRepos []githubTopRepo `json:"pinned_repos"`
+	}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp.Status != "success" || len(resp.PinnedRepos) != 2 {
+		t.Fatalf("save resp = %s", rec.Body.String())
+	}
+	if resp.PinnedRepos[0].Name != "repo-b" || resp.PinnedRepos[1].Stars != 12 {
+		t.Errorf("pinned = %+v (順序・GitHub実値の検証)", resp.PinnedRepos)
+	}
+
+	// 2) githubStatsGo に反映される(source=pinned、本人順)
+	//    github_stats キャッシュを直接置いてGitHubの/users系を呼ばせない。
+	if _, err := userRef.Update(ctx, []firestore.Update{
+		{Path: "github_stats", Value: githubStatsData{
+			TopRepos:  []githubTopRepo{{Name: "star-top"}},
+			Languages: []githubLangCount{},
+		}},
+		{Path: "github_stats_fetched_at", Value: time.Now()},
+	}); err != nil {
+		t.Fatalf("seed cache: %v", err)
+	}
+	rec = httptest.NewRecorder()
+	if err := runGithubStats(ctx, rec, client, "pin-tester", time.Now()); err != nil {
+		t.Fatalf("runGithubStats: %v", err)
+	}
+	var statsResp githubStatsResponse
+	json.Unmarshal(rec.Body.Bytes(), &statsResp)
+	if statsResp.TopReposSource != "pinned" || len(statsResp.TopRepos) != 2 ||
+		statsResp.TopRepos[0].Name != "repo-b" {
+		t.Errorf("stats resp = source=%s repos=%+v", statsResp.TopReposSource, statsResp.TopRepos)
+	}
+
+	// 3) 空配列で保存 = ピン解除 → スター上位に戻る
+	rec = httptest.NewRecorder()
+	if err := runPinnedRepos(ctx, rec, client, pinnedReposRequestBody{GithubID: uid}, "auth-uid-1"); err != nil {
+		t.Fatalf("unpin: %v", err)
+	}
+	rec = httptest.NewRecorder()
+	if err := runGithubStats(ctx, rec, client, "pin-tester", time.Now()); err != nil {
+		t.Fatalf("runGithubStats after unpin: %v", err)
+	}
+	statsResp = githubStatsResponse{}
+	json.Unmarshal(rec.Body.Bytes(), &statsResp)
+	if statsResp.TopReposSource != "stars" || len(statsResp.TopRepos) != 1 ||
+		statsResp.TopRepos[0].Name != "star-top" {
+		t.Errorf("after unpin = source=%s repos=%+v", statsResp.TopReposSource, statsResp.TopRepos)
+	}
+}
+
+func TestPinnedRepos_AuthAndValidation(t *testing.T) {
+	client := emulatorClient(t)
+	mockGithubForPins(t)
+	ctx := context.Background()
+
+	uid := "pinned-repos-test-user-2"
+	userRef := client.Collection("users").Doc(uid)
+	if _, err := userRef.Set(ctx, map[string]interface{}{
+		"screen_name":   "pin-tester",
+		"auth_user_uid": "auth-uid-2",
+	}); err != nil {
+		t.Fatalf("seed user: %v", err)
+	}
+	t.Cleanup(func() { userRef.Delete(context.Background()) })
+
+	assertNotSaved := func(label string) {
+		t.Helper()
+		snap, _ := userRef.Get(ctx)
+		if _, err := snap.DataAt("pinned_repos"); err == nil {
+			t.Errorf("%s: pinned_repos should NOT be written", label)
+		}
+	}
+
+	// UID不一致 → 403・書き込み無し
+	rec := httptest.NewRecorder()
+	if err := runPinnedRepos(ctx, rec, client, pinnedReposRequestBody{
+		GithubID: uid, Repos: []string{"repo-a"},
+	}, "attacker-uid"); err != nil {
+		t.Fatalf("mismatch: %v", err)
+	}
+	if rec.Code != http.StatusForbidden {
+		t.Errorf("uid mismatch code = %d, want 403", rec.Code)
+	}
+	assertNotSaved("uid mismatch")
+
+	// auth_user_uid 未設定 → 403
+	uid3 := "pinned-repos-test-user-3"
+	userRef3 := client.Collection("users").Doc(uid3)
+	userRef3.Set(ctx, map[string]interface{}{"screen_name": "pin-tester"})
+	t.Cleanup(func() { userRef3.Delete(context.Background()) })
+	rec = httptest.NewRecorder()
+	if err := runPinnedRepos(ctx, rec, client, pinnedReposRequestBody{
+		GithubID: uid3, Repos: []string{"repo-a"},
+	}, "any-uid"); err != nil {
+		t.Fatalf("no auth uid: %v", err)
+	}
+	if rec.Code != http.StatusForbidden {
+		t.Errorf("missing auth_user_uid code = %d, want 403", rec.Code)
+	}
+
+	// 存在しないリポジトリ → failed・書き込み無し
+	rec = httptest.NewRecorder()
+	if err := runPinnedRepos(ctx, rec, client, pinnedReposRequestBody{
+		GithubID: uid, Repos: []string{"no-such-repo"},
+	}, "auth-uid-2"); err != nil {
+		t.Fatalf("missing repo: %v", err)
+	}
+	var resp map[string]interface{}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp["status"] != "failed" {
+		t.Errorf("missing repo resp = %v", resp)
+	}
+	assertNotSaved("missing repo")
+
+	// owner不一致(移管済み等)→ failed・書き込み無し
+	rec = httptest.NewRecorder()
+	if err := runPinnedRepos(ctx, rec, client, pinnedReposRequestBody{
+		GithubID: uid, Repos: []string{"moved"},
+	}, "auth-uid-2"); err != nil {
+		t.Fatalf("moved repo: %v", err)
+	}
+	resp = map[string]interface{}{}
+	json.Unmarshal(rec.Body.Bytes(), &resp)
+	if resp["status"] != "failed" {
+		t.Errorf("owner mismatch resp = %v", resp)
+	}
+	assertNotSaved("owner mismatch")
+}
diff --git a/docs/backend.md b/docs/backend.md
index e266fe9..36ac5c1 100644
--- a/docs/backend.md
+++ b/docs/backend.md
@@ -611,3 +611,25 @@ kuda は ANU の量子真空ゆらぎ+ガイガーカウンター(放射性崩
 - `omikuji_logs` にも `entropy_batches` を記録(監査用)。
 - 接続先は env `KUDA_BASE_URL`(dev/prod とも本番kudaを使用。テストは
   httptest モックで実プールを消費しない)。
+
+## 代表リポジトリのピン留め(pinnedReposGo)
+
+公開プロフィールの代表リポジトリ(通常はスター上位4件の自動選出)を、
+本人が指定した最大6件に置き換えられる(GitHub本家のピン留め相当)。
+
+- **保存**: `POST pinnedReposGo {github_id, repos:["name",...]}`(Bearer必須)。
+  空配列 = ピン解除(自動選出へ戻る)。
+- **認可は既存より一段厳しい**: IDトークンのUIDとユーザードキュメントの
+  `auth_user_uid`(registerGoがログイン毎に維持)の一致を必須にする。
+  不一致・未設定は403(書き込み系設定のため。他人のピンは書き換えられない)。
+- **メタデータはサーバー検証**: 保存する各リポジトリを
+  `GET /repos/{screen_name}/{name}` で検証し(存在+owner一致)、取得した
+  実値(stars等)を `users/{id}.pinned_repos` に保存する。クライアント申告値は
+  使わない(スター数の自称詐称防止)。フォークは本人の明示選択なので可。
+- **表示**: `githubStatsGo` が毎リクエスト `pinned_repos` を読み、あれば
+  `top_repos` を置き換えて `top_repos_source:"pinned"` を返す(無ければ
+  `"stars"`)。github_stats の6hキャッシュとは独立なので、ピン変更は
+  CDN(s-maxage=3600)の失効後、最大1時間で公開ページに反映される。
+- **フロント**: マイページの GithubStats に `editable` を付け、
+  `RepoPicker.vue` で編集。候補一覧はブラウザから直接GitHub公開APIを取得
+  (CORS可・低頻度なので未認証60req/hで十分)。
diff --git a/web/components/GithubStats.vue b/web/components/GithubStats.vue
index 89dfe0c..9d2f697 100644
--- a/web/components/GithubStats.vue
+++ b/web/components/GithubStats.vue
@@ -62,9 +62,29 @@
         </div>
       </template>
 
-      <!-- 代表リポジトリ(スター上位) -->
-      <template v-if="stats.top_repos.length > 0">
-        <div class="gh-sub mt-3 mb-1">代表リポジトリ</div>
+      <!-- 代表リポジトリ(本人のピン留め or スター上位の自動選出) -->
+      <template v-if="stats.top_repos.length > 0 || editable">
+        <div class="d-flex align-items-center mt-3 mb-1">
+          <div class="gh-sub">
+            {{ stats.top_repos_source === "pinned" ? "📌 ピン留めリポジトリ" : "代表リポジトリ" }}
+          </div>
+          <button
+            v-if="editable && !pickerOpen"
+            class="btn btn-sm btn-outline-light ms-2 pick-btn"
+            @click="pickerOpen = true"
+          >
+            📌 選ぶ
+          </button>
+        </div>
+        <RepoPicker
+          v-if="pickerOpen"
+          class="mb-2"
+          :screen-name="screenName"
+          :github-id="githubId"
+          :initial-pinned="pinnedNames"
+          @saved="onPinsSaved"
+          @close="pickerOpen = false"
+        />
         <div class="repo-grid">
           <a
             v-for="r in stats.top_repos"
@@ -132,17 +152,30 @@ const LANG_COLORS = {
 };
 const OTHER_COLOR = "#8b949e";
 
+import RepoPicker from "@/components/RepoPicker";
+
 export default {
+  components: { RepoPicker },
   props: {
     screenName: { type: String, required: true },
+    // マイページ(本人)でのみ true: ピン留めの編集UIを出す
+    editable: { type: Boolean, default: false },
+    // 編集(pinnedReposGoへの保存)に使う。editable時のみ必要
+    githubId: { type: String, default: "" },
   },
   data() {
     return {
       state: "loading", // loading | loaded | error
       stats: null,
+      pickerOpen: false,
     };
   },
   computed: {
+    // 現在ピン留め表示中のリポジトリ名(編集パネルの初期選択)
+    pinnedNames() {
+      if (!this.stats || this.stats.top_repos_source !== "pinned") return [];
+      return (this.stats.top_repos || []).map((r) => r.name);
+    },
     githubYears() {
       if (!this.stats.account_created_at) return "-";
       const ms = Date.now() - new Date(this.stats.account_created_at).getTime();
@@ -186,12 +219,29 @@ export default {
     langColor(name) {
       return LANG_COLORS[name] || OTHER_COLOR;
     },
-    async fetchStats() {
+    // 保存成功 → サーバー検証済みのピンで即時反映(公開ページはCDN失効後に追従)
+    onPinsSaved(pinned) {
+      if (pinned.length > 0) {
+        this.stats = {
+          ...this.stats,
+          top_repos: pinned,
+          top_repos_source: "pinned",
+        };
+      } else {
+        // ピン解除はスター上位に戻る。CDNの古い応答を掴まないよう
+        // キャッシュバスター付きで取り直す
+        this.fetchStats(true);
+      }
+      this.pickerOpen = false;
+    },
+    async fetchStats(bustCache) {
       this.state = "loading";
       try {
+        const params = { user: this.screenName };
+        if (bustCache) params._ = Date.now();
         const res = await this.$axios.get("/githubStatsGo", {
           baseURL: this.$config.rankingBaseUrl || this.$config.apiUrl,
-          params: { user: this.screenName },
+          params: params,
         });
         this.stats = res.data;
         this.state = "loaded";
diff --git a/web/components/RepoPicker.vue b/web/components/RepoPicker.vue
new file mode 100644
index 0000000..4a632a2
--- /dev/null
+++ b/web/components/RepoPicker.vue
@@ -0,0 +1,256 @@
+<template>
+  <div class="repo-picker rounded p-3">
+    <div class="d-flex justify-content-between align-items-center mb-2">
+      <div class="picker-title">📌 表示するリポジトリを選ぶ</div>
+      <button class="btn btn-sm btn-outline-light" @click="$emit('close')">
+        閉じる
+      </button>
+    </div>
+    <p class="picker-sub mb-2">
+      最大{{ maxPins }}件まで。選んだ順に表示されます。公開ページへの反映には最大1時間かかることがあります。
+    </p>
+
+    <div v-if="state === 'loading'" class="picker-sub py-3">
+      リポジトリ一覧を取得しています<span class="dots"></span>
+    </div>
+    <div v-else-if="state === 'error'" class="py-2">
+      <span class="picker-sub">一覧を取得できませんでした(GitHub APIの制限の可能性)。</span>
+      <button class="btn btn-sm btn-outline-light ms-2" @click="fetchCandidates">
+        もう一度
+      </button>
+    </div>
+    <template v-else>
+      <input
+        v-model="filter"
+        type="text"
+        class="form-control form-control-sm mb-2"
+        placeholder="リポジトリ名で絞り込み"
+      />
+      <div class="candidates rounded">
+        <label
+          v-for="repo in filteredCandidates"
+          :key="repo.name"
+          class="candidate d-flex align-items-center"
+          :class="{ selected: selectedIndex(repo.name) >= 0 }"
+        >
+          <input
+            type="checkbox"
+            class="me-2"
+            :checked="selectedIndex(repo.name) >= 0"
+            :disabled="selectedIndex(repo.name) < 0 && selected.length >= maxPins"
+            @change="toggle(repo.name)"
+          />
+          <span class="candidate-order me-2" v-if="selectedIndex(repo.name) >= 0"
+            >{{ selectedIndex(repo.name) + 1 }}</span
+          >
+          <span class="candidate-name flex-fill">
+            {{ repo.name }}
+            <span v-if="repo.fork" class="picker-sub">(fork)</span>
+          </span>
+          <span class="picker-sub">⭐ {{ repo.stars }}</span>
+        </label>
+        <div v-if="filteredCandidates.length === 0" class="picker-sub p-2">
+          該当するリポジトリがありません。
+        </div>
+      </div>
+
+      <div class="d-flex align-items-center mt-3 flex-wrap gap-2">
+        <button
+          class="btn btn-sm btn-accent me-2"
+          :disabled="saveState === 'saving'"
+          @click="save(selected)"
+        >
+          {{ saveState === "saving" ? "保存中..." : `この${selected.length}件を表示する` }}
+        </button>
+        <button
+          class="btn btn-sm btn-outline-light me-2"
+          :disabled="saveState === 'saving'"
+          @click="save([])"
+        >
+          おまかせ(スター上位)に戻す
+        </button>
+        <span v-if="saveState === 'error'" class="picker-error">{{
+          saveError
+        }}</span>
+      </div>
+    </template>
+  </div>
+</template>
+
+<script>
+// 代表リポジトリのピン留め編集パネル(マイページ専用)。
+// 候補一覧はブラウザから直接GitHub公開APIで取得(CORS可・低頻度なので
+// 未認証の60req/hで十分)。保存はpinnedReposGoがGitHubで実在・所有を検証する。
+import { getAuth, onAuthStateChanged } from "firebase/auth";
+
+function resolveCurrentUser(auth) {
+  return new Promise((resolve) => {
+    const unsubscribe = onAuthStateChanged(auth, (user) => {
+      unsubscribe();
+      resolve(user);
+    });
+  });
+}
+
+export default {
+  props: {
+    screenName: { type: String, required: true },
+    githubId: { type: String, required: true },
+    // 現在のピン(リポジトリ名の配列)。初期選択に使う。
+    initialPinned: { type: Array, default: () => [] },
+  },
+  data() {
+    return {
+      maxPins: 6,
+      state: "loading", // loading | loaded | error
+      candidates: [], // [{name, stars, fork}]
+      filter: "",
+      selected: [...this.initialPinned], // 選択順を保持したリポジトリ名
+      saveState: "idle", // idle | saving | error
+      saveError: "",
+    };
+  },
+  computed: {
+    filteredCandidates() {
+      const q = this.filter.trim().toLowerCase();
+      if (!q) return this.candidates;
+      return this.candidates.filter((r) => r.name.toLowerCase().includes(q));
+    },
+  },
+  async mounted() {
+    await this.fetchCandidates();
+  },
+  methods: {
+    selectedIndex(name) {
+      return this.selected.indexOf(name);
+    },
+    toggle(name) {
+      const i = this.selected.indexOf(name);
+      if (i >= 0) {
+        this.selected.splice(i, 1);
+      } else if (this.selected.length < this.maxPins) {
+        this.selected.push(name);
+      }
+    },
+    async fetchCandidates() {
+      this.state = "loading";
+      try {
+        const repos = [];
+        for (let page = 1; page <= 3; page++) {
+          const res = await fetch(
+            `https://api.github.com/users/${encodeURIComponent(
+              this.screenName
+            )}/repos?per_page=100&type=owner&sort=pushed&page=${page}`
+          );
+          if (!res.ok) throw new Error(`github api: ${res.status}`);
+          const batch = await res.json();
+          repos.push(...batch);
+          if (batch.length < 100) break;
+        }
+        this.candidates = repos
+          .map((r) => ({ name: r.name, stars: r.stargazers_count, fork: r.fork }))
+          .sort((a, b) => b.stars - a.stars);
+        this.state = "loaded";
+      } catch (e) {
+        this.state = "error";
+      }
+    },
+    async save(names) {
+      this.saveState = "saving";
+      this.saveError = "";
+      try {
+        const auth = getAuth();
+        const currentUser = await resolveCurrentUser(auth);
+        if (!currentUser) throw new Error("not logged in");
+        const token = await currentUser.getIdToken();
+        const res = await this.$axios.post(
+          "pinnedReposGo",
+          { github_id: this.githubId, repos: names },
+          { headers: { Authorization: `Bearer ${token}` } }
+        );
+        if (res.data.status !== "success") {
+          throw new Error(res.data.message || "保存に失敗しました");
+        }
+        this.saveState = "idle";
+        this.$emit("saved", res.data.pinned_repos || []);
+      } catch (e) {
+        this.saveState = "error";
+        this.saveError =
+          (e && e.message) || "保存に失敗しました。時間をおいて試してください。";
+      }
+    },
+  },
+};
+</script>
+
+<style scoped>
+.repo-picker {
+  background: rgba(255, 255, 255, 0.04);
+  border: 1px dashed rgba(255, 255, 255, 0.2);
+}
+.picker-title {
+  font-weight: 700;
+}
+.picker-sub {
+  color: var(--color-text-muted, #9a9a9a);
+  font-size: 0.82rem;
+}
+.picker-error {
+  color: #ff8080;
+  font-size: 0.85rem;
+}
+
+.candidates {
+  max-height: 260px;
+  overflow-y: auto;
+  border: 1px solid rgba(255, 255, 255, 0.1);
+}
+.candidate {
+  padding: 6px 10px;
+  cursor: pointer;
+  border-bottom: 1px solid rgba(255, 255, 255, 0.06);
+  margin: 0;
+  font-size: 0.9rem;
+}
+.candidate:hover {
+  background: rgba(255, 255, 255, 0.05);
+}
+.candidate.selected {
+  background: rgba(255, 196, 120, 0.1);
+}
+.candidate-order {
+  display: inline-block;
+  min-width: 1.4em;
+  text-align: center;
+  background: rgba(255, 196, 120, 0.85);
+  color: #2b211b;
+  font-weight: 700;
+  font-size: 0.75rem;
+  border-radius: 999px;
+}
+.candidate-name {
+  word-break: break-all;
+}
+
+.dots::after {
+  content: "";
+  animation: picker-dots 1.2s steps(4, end) infinite;
+}
+@keyframes picker-dots {
+  0% {
+    content: "";
+  }
+  25% {
+    content: "・";
+  }
+  50% {
+    content: "・・";
+  }
+  75% {
+    content: "・・・";
+  }
+  100% {
+    content: "";
+  }
+}
+</style>
diff --git a/web/pages/dashboard/index.vue b/web/pages/dashboard/index.vue
index f6cf2a3..f3f0bf2 100644
--- a/web/pages/dashboard/index.vue
+++ b/web/pages/dashboard/index.vue
@@ -110,6 +110,8 @@
         v-if="user && user.screen_name"
         class="mt-4"
         :screen-name="user.screen_name"
+        :github-id="user.github_id"
+        editable
       />
       <SanpaiGrass
         v-if="user && user.screen_name"