diff --git a/scripts/audit-core-recovery-preflight.py b/scripts/audit-core-recovery-preflight.py
index 8268f94..641893c 100755
--- a/scripts/audit-core-recovery-preflight.py
+++ b/scripts/audit-core-recovery-preflight.py
@@ -20,9 +20,11 @@ from pathlib import Path
 from typing import Any
 
 
+# audit-core release pinned by audit-core 1269a0e (2026-10-15, deploy/audit-core.yaml);
+# the previously reviewed ec15f63d image now remains only on the attest-chain CronJob.
 EXPECTED_IMAGE = (
     "forgejo.coulomb.social/coulomb/audit-core@"
-    "sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615"
+    "sha256:b479801b0bc76df66a36a85376c45aaf399c6d82feade9ba81430b774c4a8271"
 )
 EXPECTED_DB_KEYS = {"username", "password", "host", "port", "dbname"}