diff --git a/.github/workflows/org-quality-gate.yml b/.github/workflows/org-quality-gate.yml
index b74469a..083cc17 100644
--- a/.github/workflows/org-quality-gate.yml
+++ b/.github/workflows/org-quality-gate.yml
@@ -15,8 +15,8 @@ permissions:
 jobs:
   quality-gate:
     name: quality-gate
-    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@f6d083035f7501b3385790f95c9f344cab1038e3
+    uses: agiletec-inc/github-actions/.github/workflows/quality-gate.yml@7c4b4d724552e277559a094ddd4536f9592c6e8a
     with:
-      source-ref: f6d083035f7501b3385790f95c9f344cab1038e3
+      source-ref: 7c4b4d724552e277559a094ddd4536f9592c6e8a
       linux-runs-on: ${{ github.event.repository.private && 'org-shared-ci-light' || 'ubuntu-latest' }}
       swift-runs-on: macos-latest
diff --git a/.github/workflows/quality-gate.yml b/.github/workflows/quality-gate.yml
index 10b634f..b88b128 100644
--- a/.github/workflows/quality-gate.yml
+++ b/.github/workflows/quality-gate.yml
@@ -186,7 +186,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           REQUIRED_CONTEXTS: ${{ needs.detect.outputs.required_contexts }}
-          TARGET_SHA: ${{ github.sha }}
+          TARGET_SHA: ${{ github.event.pull_request.head.sha || github.sha }}
         run: |
           set -uo pipefail
           deadline=$((SECONDS + 900))
diff --git a/tests/test_workflow_wiring.py b/tests/test_workflow_wiring.py
index 9385196..7095c7a 100644
--- a/tests/test_workflow_wiring.py
+++ b/tests/test_workflow_wiring.py
@@ -66,6 +66,13 @@ def test_native_gate_pending_status_is_captured_under_errexit(self) -> None:
             source,
         )
 
+    def test_native_gate_checks_pr_head_and_merge_group_sha(self) -> None:
+        source = QUALITY_GATE.read_text()
+        self.assertIn(
+            "TARGET_SHA: ${{ github.event.pull_request.head.sha || github.sha }}",
+            source,
+        )
+
 
 if __name__ == "__main__":
     unittest.main()