diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 64972a7..5ae11d5 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -4,7 +4,7 @@
 version: 'v0.0.2'
 workflows:
     '.github/workflows/ci-contexts.yml':
-        - 'actions/checkout@v4.4.0'
+        - 'actions/checkout@v7.0.1'
     '.github/workflows/governance.yml': []
     '.github/workflows/hypatia-scan.yml': []
     '.github/workflows/label-triage.yml': []
@@ -20,6 +20,11 @@ dependencies:
         commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'hyperpolymath/smtp-notify-action@v0.2.0':
         ref: 'v0.2.0'
         commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
diff --git a/.github/workflows/ci-contexts.yml b/.github/workflows/ci-contexts.yml
index 7c7af19..cfac113 100644
--- a/.github/workflows/ci-contexts.yml
+++ b/.github/workflows/ci-contexts.yml
@@ -1,24 +1,50 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# CI context contract — the guard for docs/CI-CONTEXTS.adoc.
+#
+# WHY THIS JOB EXISTS: a required status check is matched by string equality
+# against the check-run name GitHub publishes. A required name nothing can
+# publish blocks every pull request while the board shows green (issue #17), and
+# the failure is invisible from the CI side. tools/check-ci-contexts.sh makes both
+# halves visible: the offline contract check fails the build when the published
+# string would drift, and the live half reports any required context this
+# repository's workflows cannot produce.
+#
+# The live half reads the repository's branch rules. A credential with
+# `Administration: read` sees more than the Actions token does — legacy branch
+# protection is only readable with one — so this job deliberately uses
+# `github.token` (no secret context referenced, hence no egress-review finding)
+# and reports exactly what it could not read rather than guessing. Run it locally
+# with a broader credential (`GH_TOKEN=… bash tools/check-ci-contexts.sh .`) to
+# get that extra coverage.
 name: CI context contract
+
 on:
   pull_request:
   push:
     branches: [main, master]
   workflow_dispatch:
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
+
 permissions:
   contents: read
+
 jobs:
   contract:
+    name: Required contexts are producible
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4.4.0
+      - name: Checkout
+        uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Check the CI context contract
         env:
           GITHUB_REPOSITORY: ${{ github.repository }}
-          GH_TOKEN: ${{ secrets.HYPATIA_SCAN_PAT || secrets.GITHUB_TOKEN }}
+          GH_TOKEN: ${{ github.token }}
         run: bash tools/check-ci-contexts.sh .