diff --git a/.github/workflows/mantis-telegram-desktop-proof.yml b/.github/workflows/mantis-telegram-desktop-proof.yml
index b505924dacc..38eb79b2c6d 100644
--- a/.github/workflows/mantis-telegram-desktop-proof.yml
+++ b/.github/workflows/mantis-telegram-desktop-proof.yml
@@ -225,6 +225,7 @@ jobs:
       - name: Checkout harness ref
         uses: actions/checkout@v6
         with:
+          ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
           fetch-depth: 0
 
diff --git a/src/agents/auth-profiles/legacy-oauth-sidecar.ts b/src/agents/auth-profiles/legacy-oauth-sidecar.ts
index 80d22cfeaff..f7142fd78bd 100644
--- a/src/agents/auth-profiles/legacy-oauth-sidecar.ts
+++ b/src/agents/auth-profiles/legacy-oauth-sidecar.ts
@@ -119,6 +119,7 @@ function buildLegacyOAuthSecretKey(seed: string): Buffer {
   // Legacy #79006 compatibility: existing sidecars were encrypted with this
   // SHA-256 key derivation, so changing it would strand affected users.
   // codeql[js/insufficient-password-hash]
+  // lgtm[js/insufficient-password-hash]
   return createHash("sha256").update(`openclaw:auth-profile-oauth:${seed}`).digest();
 }