diff --git a/.github/workflows/public-pii-gate-caller.yml b/.github/workflows/public-pii-gate-caller.yml
index 4af60162..499add13 100644
--- a/.github/workflows/public-pii-gate-caller.yml
+++ b/.github/workflows/public-pii-gate-caller.yml
@@ -10,5 +10,5 @@ on:
 
 jobs:
   pii-gate:
-    uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@main
+    uses: tracebloc/.github/.github/workflows/public-pii-gate.yml@fix/pii-gate-token-perms
     secrets: inherit
diff --git a/PII_GATE_SMOKE.md b/PII_GATE_SMOKE.md
new file mode 100644
index 00000000..96d5e4fb
--- /dev/null
+++ b/PII_GATE_SMOKE.md
@@ -0,0 +1,6 @@
+# PII gate smoke check
+
+Verifies the public-pii-gate reusable workflow resolves from @main after publishing.
+Safe to delete. Tracking: tracebloc/.github#62
+
+(synchronize trigger to force a fresh gate run post-publish)