diff --git a/docs/plans/release-rules.md b/docs/plans/release-rules.md
index 6b849613..45f202ce 100644
--- a/docs/plans/release-rules.md
+++ b/docs/plans/release-rules.md
@@ -18,3 +18,4 @@ Every cut of the Igneum Miner app and its node runs under these. The dated plan
 11. **Kill by pid, never by name,** on the shared Mac; a merge worktree never checks out master.
 12. **The Discord card only when every platform is live.** Live manifest changes beyond the binaries (a moved consensus floor) go out only on the project lead's explicit word, staged beside the release with their digest and a one-line diff.
 13. **Ship on green:** no calendar waits; when the gates are green, publish and state the clock time (UK). Checkpoints are for slips, not for waiting.
+14. **Master is re-pinned at every publish (main, 7 October 2026).** packaging/windows/node-source.pin on master names the node commit of the published payload-inputs.json; a publish that moves the pin re-pins master through merge-to-master.sh in the same hour, or master's windows-ci reads red at its "payload inputs" step on every run (6 to 7 October: four red runs on the stale pin). The pin check is a named line in the cut list.
diff --git a/packaging/windows/node-source.pin b/packaging/windows/node-source.pin
index 06cb181a..4f9fa57d 100644
--- a/packaging/windows/node-source.pin
+++ b/packaging/windows/node-source.pin
@@ -1 +1 @@
-4c6b129d75c3d77a3689d22f1e1dc721b556aebb
+c4459193ff5ada38df21f900c91026d3f07c963f