diff --git a/.changeset/5665-governance-agent-url-seller-stub.md b/.changeset/5665-governance-agent-url-seller-stub.md
new file mode 100644
index 0000000000..31f8422eb1
--- /dev/null
+++ b/.changeset/5665-governance-agent-url-seller-stub.md
@@ -0,0 +1,4 @@
+---
+---
+
+Empty changeset: Default `governance_agent_url` in the `governance_denied` / `governance_denied_recovery` storyboards to a seller-local stub served by the seller's `comply_test_controller`, removing the counterparty-supplied-URL egress/SSRF surface. Alternative to #5665 Option A; depends on runner support for a controller-self-URL placeholder. Addresses #5665 (Option B).
diff --git a/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml b/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml
index 224d3a451f..56274cb69b 100644
--- a/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml
+++ b/static/compliance/source/protocols/media-buy/scenarios/governance_denied.yaml
@@ -23,7 +23,15 @@ narrative: |
   (e.g., via `--context` on `adcp storyboard run` once the CLI supports it).
 
 context:
-  governance_agent_url: "https://test-agent.adcontextprotocol.org"
+  # Option B (#5665): default the governance agent to a seller-local stub served
+  # by the seller's own comply_test_controller, instead of the external training
+  # agent. This removes the counterparty-supplied-URL egress/SSRF surface (the
+  # seller calls its own controller) and lets sellers without an external
+  # governance agent still exercise the denial path. NOTE: depends on the runner
+  # exposing a controller-self-URL placeholder (cf. {{runner.webhook_url:...}});
+  # {{runner.controller_url}} does not exist yet — adcp-client support required.
+  # An explicit --context governance_agent_url still overrides this default.
+  governance_agent_url: "{{runner.controller_url}}/stub-governance-agent"
 
 agent:
   interaction_model: media_buy_seller
diff --git a/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml b/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml
index 4dbefa2064..f0b1dc4227 100644
--- a/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml
+++ b/static/compliance/source/protocols/media-buy/scenarios/governance_denied_recovery.yaml
@@ -24,7 +24,15 @@ narrative: |
   (e.g., via `--context` on `adcp storyboard run` once the CLI supports it).
 
 context:
-  governance_agent_url: "https://test-agent.adcontextprotocol.org"
+  # Option B (#5665): default the governance agent to a seller-local stub served
+  # by the seller's own comply_test_controller, instead of the external training
+  # agent. This removes the counterparty-supplied-URL egress/SSRF surface (the
+  # seller calls its own controller) and lets sellers without an external
+  # governance agent still exercise the denial path. NOTE: depends on the runner
+  # exposing a controller-self-URL placeholder (cf. {{runner.webhook_url:...}});
+  # {{runner.controller_url}} does not exist yet — adcp-client support required.
+  # An explicit --context governance_agent_url still overrides this default.
+  governance_agent_url: "{{runner.controller_url}}/stub-governance-agent"
 
 agent:
   interaction_model: media_buy_seller