diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml
index ef2de8e..f4b00e7 100644
--- a/.github/workflows/org-quality-gate.yml
+++ b/.github/workflows/org-quality-gate.yml
@@ -15,8 +15,8 @@ permissions:
 jobs:
   quality-gate:
     name: quality-gate
-    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@16a8f9b0b224c8e1483afac86ea9a00636d777d0
+    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@0a4e9e230b3da52a40a0fe4ab0ae6f6f6971574b
     with:
-      source-ref: 16a8f9b0b224c8e1483afac86ea9a00636d777d0
+      source-ref: 0a4e9e230b3da52a40a0fe4ab0ae6f6f6971574b
       linux-runs-on: ${{ github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }}
       swift-runs-on: macos-latest
diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
index e807cac..0c20e36 100644
--- a/.github/workflows/quality-gate.yml
+++ b/.github/workflows/quality-gate.yml
@@ -54,6 +54,19 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
+      - name: Fetch gate comparison revisions
+        shell: bash
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          set -euo pipefail
+          if [[ ! "$BASE_SHA" =~ ^[0-9a-f]{40}$ || ! "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
+            echo 'Unable to resolve gate comparison revisions.' >&2
+            exit 1
+          fi
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"
       - name: Check out quality gate implementation
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
diff --git a/tests/test_workflow_wiring.py b/tests/test_workflow_wiring.py
index e1a1ba2..956ed90 100644
--- a/tests/test_workflow_wiring.py
+++ b/tests/test_workflow_wiring.py
@@ -31,6 +31,18 @@ def test_quality_gate_resolves_source_once_and_never_checks_out_main(self) -> No
         self.assertIn("source_sha", source)
         self.assertRegex(source, r"ref:\s*\$\{\{[^}]*source_sha[^}]*\}\}")
 
+    def test_comparison_revisions_are_fetched_before_source_checkout(self) -> None:
+        source = QUALITY_GATE.read_text()
+        fetch_index = source.index("name: Fetch gate comparison revisions")
+        source_checkout_index = source.index("name: Check out quality gate implementation")
+
+        self.assertLess(fetch_index, source_checkout_index)
+        self.assertIn(
+            'git config --global --add safe.directory "$GITHUB_WORKSPACE"',
+            source,
+        )
+        self.assertIn('git fetch --no-tags --depth=1 origin "$BASE_SHA" "$HEAD_SHA"', source)
+
     def test_org_caller_grants_read_only_checks_and_actions_access(self) -> None:
         source = ORG_CALLER.read_text()
         self.assertRegex(source, r"(?m)^\s*actions:\s*read\s*$")