diff --git a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
index 5e04db62d08..79c877378e2 100644
--- a/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
+++ b/.github/workflows/smoke-workflow-call-with-inputs.lock.yml
@@ -191,6 +191,7 @@ jobs:
         env:
           GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github"
           GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md"
+        # poutine:ignore untrusted_checkout_exec
         run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
       - name: Check workflow lock file
         id: check-lock-file
diff --git a/.github/workflows/smoke-workflow-call.lock.yml b/.github/workflows/smoke-workflow-call.lock.yml
index 72f9933fe7e..f115adde941 100644
--- a/.github/workflows/smoke-workflow-call.lock.yml
+++ b/.github/workflows/smoke-workflow-call.lock.yml
@@ -194,6 +194,7 @@ jobs:
         env:
           GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github"
           GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md"
+        # poutine:ignore untrusted_checkout_exec
         run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
       - name: Check workflow lock file
         id: check-lock-file
diff --git a/pkg/workflow/pr.go b/pkg/workflow/pr.go
index 5e3bbb7147e..c583b5b25f6 100644
--- a/pkg/workflow/pr.go
+++ b/pkg/workflow/pr.go
@@ -29,6 +29,7 @@ func generateSaveBaseGitHubFoldersStep(folders, files []string) []string {
 	lines = append(lines, "        env:\n")
 	lines = append(lines, fmt.Sprintf("          GH_AW_AGENT_FOLDERS: \"%s\"\n", strings.Join(folders, " ")))
 	lines = append(lines, fmt.Sprintf("          GH_AW_AGENT_FILES: \"%s\"\n", strings.Join(files, " ")))
+	lines = append(lines, "        # poutine:ignore untrusted_checkout_exec\n")
 	lines = append(lines, "        run: bash \"${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh\"\n")
 	return lines
 }
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden
index d0dd21e2cba..6fc5c5d9d1f 100644
--- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden
+++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/basic-copilot.golden
@@ -93,6 +93,7 @@ jobs:
         env:
           GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github"
           GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md"
+        # poutine:ignore untrusted_checkout_exec
         run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
       - name: Check workflow lock file
         id: check-lock-file
diff --git a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden
index 54c24d424a0..a1adaf0670c 100644
--- a/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden
+++ b/pkg/workflow/testdata/TestWasmGolden_CompileFixtures/with-imports.golden
@@ -93,6 +93,7 @@ jobs:
         env:
           GH_AW_AGENT_FOLDERS: ".agents .claude .codex .gemini .github"
           GH_AW_AGENT_FILES: "AGENTS.md CLAUDE.md GEMINI.md"
+        # poutine:ignore untrusted_checkout_exec
         run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
       - name: Check workflow lock file
         id: check-lock-file