diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c18e5d4..2547726 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,21 +122,14 @@ jobs:
       - name: Verify and safely auto-fix external contracts
         id: verify-contracts
         run: uv run python .github/scripts/verify-marketplace-urls.py --fix
-      - name: Commit timestamp-only refresh to main
-        if: steps.verify-contracts.outputs.canonical_url_fix_count == '0' && steps.verify-contracts.outputs.timestamp_refresh_count != '0'
-        run: |
-          git add docs/evidence-urls.json
-          git -c user.name="GitHub Actions" -c user.email="actions@github.com" commit -m "chore: refresh verification timestamps" --signoff
-          git push origin HEAD:main
-      - name: Open PR for canonical URL corrections
-        if: steps.verify-contracts.outputs.canonical_url_fix_count != '0'
+      - name: Open PR for drift fixes
+        if: steps.verify-contracts.outputs.canonical_url_fix_count != '0' || steps.verify-contracts.outputs.timestamp_refresh_count != '0'
         id: create-pr
         uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           add-paths: docs/evidence-urls.json
           sign-commits: true
-          labels: needs:semantic-review
           commit-message: "chore: auto-fix URL drift detected by contract monitor"
           title: "chore: auto-fix URL drift detected by contract monitor"
           body: |
@@ -147,12 +140,21 @@ jobs:
             - Verification timestamps refreshed: ${{ steps.verify-contracts.outputs.timestamp_refresh_count }}
             - Canonical URL corrections: ${{ steps.verify-contracts.outputs.canonical_url_fix_count }}
 
-            This change contains canonical URL corrections that require
-            semantic review of the affected provider contract before merging.
-            Timestamp-only refreshes are committed directly to main and no
-            longer open pull requests.
+            Timestamp-only refreshes are auto-merged on a green run.
+            Canonical URL corrections require semantic review of the affected
+            provider contract and are labeled `needs:semantic-review`.
           branch: automation/external-contract-drift
           delete-branch: true
+      - name: Flag semantic fixes for review
+        if: steps.create-pr.outputs.pull-request-number != '' && steps.verify-contracts.outputs.canonical_url_fix_count != '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr edit "${{ steps.create-pr.outputs.pull-request-number }}" --repo CodeSigils/skill-discovery --add-label "needs:semantic-review"
+      - name: Auto-merge timestamp-only refresh
+        if: steps.create-pr.outputs.pull-request-number != '' && steps.verify-contracts.outputs.canonical_url_fix_count == '0'
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: gh pr merge "${{ steps.create-pr.outputs.pull-request-number }}" --repo CodeSigils/skill-discovery --auto --squash --delete-branch
       - name: Check research expiry and create issues
         run: uv run python .github/scripts/verify-marketplace-urls.py --check-expiry
         env: