diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 0d3bfeee50..86dfbb066c 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -90,11 +90,9 @@ jobs:
             fail "branch metadata is not an approved ref"
 
           if [ "$D2B_EVENT_NAME" = "pull_request_target" ]; then
-            [ "$D2B_CALLER_WORKFLOW_REF" =
-              "vicondoa/d2b/.github/workflows/pr.yml@refs/heads/main" ] ||
+            [ "$D2B_CALLER_WORKFLOW_REF" = "vicondoa/d2b/.github/workflows/pr.yml@refs/heads/main" ] ||
               fail "PR workflow controls must be sourced from protected main"
-            [ "$D2B_JOB_WORKFLOW_REF" =
-              "vicondoa/d2b/.github/workflows/build.yaml@refs/heads/main" ] ||
+            [ "$D2B_JOB_WORKFLOW_REF" = "vicondoa/d2b/.github/workflows/build.yaml@refs/heads/main" ] ||
               fail "reusable build controls must be sourced from protected main"
             case "$D2B_BASE_REF" in
               main|v3) ;;
@@ -110,8 +108,7 @@ jobs:
             tested_sha="$D2B_MERGE_SHA"
             instance="d2b/pr/$D2B_PR_NUMBER/$D2B_HEAD_SHA/linux-x86_64/rules_rs/worker-v1/minimal/lock-v1"
           elif [ "$D2B_EVENT_NAME" = "push" ]; then
-            [ "$D2B_CALLER_WORKFLOW_REF" =
-              "vicondoa/d2b/.github/workflows/build.yaml@refs/heads/main" ] ||
+            [ "$D2B_CALLER_WORKFLOW_REF" = "vicondoa/d2b/.github/workflows/build.yaml@refs/heads/main" ] ||
               fail "push workflow controls must be sourced from protected main"
             [ "$D2B_REF" = "refs/heads/main" ] ||
               fail "trusted build pushes are restricted to main"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 4a599ba1c0..3470866c68 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -10,4 +10,4 @@ permissions:
 jobs:
   build:
     name: build
-    uses: vicondoa/d2b/.github/workflows/build.yaml@refs/heads/main
+    uses: vicondoa/d2b/.github/workflows/build.yaml@main
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ddeb05f562..19e54b4986 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,6 +42,12 @@ deprecations ship one minor release before removal.
   window unlabelled. Adds the `proofs/window-identity-chrome/` proof for the
   geometry, parts, contrast, and label logic.
 
+### Fixed
+
+- Fixed trusted `main` push validation and reusable workflow resolution so the
+  BuildBuddy seed workflow executes its metadata checks instead of failing on
+  shell test parsing.
+
 ## [1.4.1] - 2026-07-12
 
 ### Added
diff --git a/packages/xtask/tests/policy_ci.rs b/packages/xtask/tests/policy_ci.rs
index c156983e27..b50f4362a9 100644
--- a/packages/xtask/tests/policy_ci.rs
+++ b/packages/xtask/tests/policy_ci.rs
@@ -141,7 +141,8 @@ fn main_controlled_buildbuddy_workflows_preserve_trust_contract() {
         "PR workflow must not run untrusted pull_request controls"
     );
     assert!(
-        pr.contains("uses: vicondoa/d2b/.github/workflows/build.yaml@refs/heads/main")
+        pr.contains("uses: vicondoa/d2b/.github/workflows/build.yaml@main")
+            && !pr.contains("uses: vicondoa/d2b/.github/workflows/build.yaml@refs/heads/main")
             && !pr.contains("D2B_BUILDBUDDY_API_KEY")
             && !pr.contains("secrets: inherit"),
         "PR workflow must call the main-owned reusable build at main without PR secret access"