diff --git a/knowledge-fs/.harness/changes/2026-09-03-fast-uri-security-upgrade.md b/knowledge-fs/.harness/changes/2026-09-03-fast-uri-security-upgrade.md
index 5dba2f1f1c9..77cc29ba728 100644
--- a/knowledge-fs/.harness/changes/2026-09-03-fast-uri-security-upgrade.md
+++ b/knowledge-fs/.harness/changes/2026-09-03-fast-uri-security-upgrade.md
@@ -13,6 +13,7 @@ first patched 3.x release, and the KnowledgeFS production-dependency audit block
 ## Verification
 
 - `pnpm security:dependencies`: passed.
+- `pnpm ci:workflow:test`: passed.
 - `pnpm --filter @knowledge/api typecheck`: passed.
 - `git diff --check`: passed.
 
diff --git a/knowledge-fs/scripts/github-actions-workflow.test.mjs b/knowledge-fs/scripts/github-actions-workflow.test.mjs
index 53a264b28d9..a33de3366c8 100644
--- a/knowledge-fs/scripts/github-actions-workflow.test.mjs
+++ b/knowledge-fs/scripts/github-actions-workflow.test.mjs
@@ -203,11 +203,11 @@ test("root workflow runs explicit local security gates", () => {
 
 test("production dependency security fixes stay locked", () => {
   assert.equal(apiPackageJson.dependencies.sharp, "^0.35.3");
-  assert.equal(packageJson.pnpm.overrides["fast-uri"], "3.1.5");
+  assert.equal(packageJson.pnpm.overrides["fast-uri"], "3.1.6");
   assert.equal(packageJson.pnpm.overrides["ip-address"], "10.3.1");
   assert.equal(packageJson.pnpm.overrides.sharp, "0.35.3");
-  assert.match(lockfile, /^ {2}fast-uri@3\.1\.5:$/m);
-  assert.doesNotMatch(lockfile, /^ {2}fast-uri@3\.1\.4:$/m);
+  assert.match(lockfile, /^ {2}fast-uri@3\.1\.6:$/m);
+  assert.doesNotMatch(lockfile, /^ {2}fast-uri@3\.1\.5:$/m);
   assert.match(lockfile, /^ {2}ip-address@10\.3\.1:$/m);
   assert.doesNotMatch(lockfile, /^ {2}ip-address@10\.2\.0:$/m);
   assert.match(lockfile, /^ {2}sharp@0\.35\.3:$/m);