diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index ebb4f9f..d7288d6 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -5,6 +5,10 @@ name: Security gate
 # checked out as data only: nothing from it is executed, no secrets are exposed,
 # and the token is read-only. The toolchain is installed before any pull request
 # file is on disk.
+#
+# The scanner is the latest stable am-i-hacked release from npm, pinned to an exact
+# version, never the unreleased source on main. Bump AIH_VERSION when a new release
+# ships (docs/RELEASING.md).
 on:
   push:
     branches: [main]
@@ -13,6 +17,9 @@ on:
 permissions:
   contents: read
 
+env:
+  AIH_VERSION: 2.0.1
+
 jobs:
   security-gate:
     name: Security gate
@@ -41,9 +48,9 @@ jobs:
       - name: Scan
         env:
           TARGET: ${{ github.event_name == 'pull_request_target' && '.review' || '.' }}
-        run: bash apps/am-i-hacked/bin/scanner.sh "$TARGET"
+        run: npx --yes "am-i-hacked@${AIH_VERSION}" "$TARGET"
 
       - name: Scan runner (login items, crontab, shell startup, agent config, processes)
-        run: bash apps/am-i-hacked/bin/scanner.sh --system
+        run: npx --yes "am-i-hacked@${AIH_VERSION}" --system
         # The hosted runner image is not ours; report its findings without blocking merges.
         continue-on-error: true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index eb65d1c..aa0b9ea 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 Newest first. One line per change. Default-behavior changes marked **CHANGED**. Package versions in brackets.
 
+## 2026-10-10
+
+### CI
+- **CHANGED:** the security gate (`.github/workflows/gate.yml`) runs the latest stable `am-i-hacked` release from npm, pinned to an exact version, instead of the unreleased scanner on `main` (#6).
+
 ## 2026-10-05
 
 ### Skills
diff --git a/SECURITY.md b/SECURITY.md
index 82bfda2..f7d7dbe 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -69,4 +69,4 @@ gh api -X POST repos/IsaacBell/secure-devtools/security-advisories --input advis
 
 ## CI gates
 
-The security gate (`.github/workflows/gate.yml`) runs on `pull_request_target` and on pushes to `main`. For pull requests, the workflow file, the scanner, and the toolchain come from the base branch. The pull request's code is checked out into `.review` as data and is never executed. The job has read-only permissions and no secrets. Keep it that way: any step that runs code from `.review` turns this into a way to attack the repository.
+The security gate (`.github/workflows/gate.yml`) runs on `pull_request_target` and on pushes to `main`. For pull requests, the workflow file and the toolchain come from the base branch, and the scanner is the latest stable `am-i-hacked` release from npm, pinned to an exact version (`AIH_VERSION`), not the unreleased source on `main`. The pull request's code is checked out into `.review` as data and is never executed. The job has read-only permissions and no secrets. Keep it that way: any step that runs code from `.review` turns this into a way to attack the repository.
diff --git a/docs/RELEASING.md b/docs/RELEASING.md
index 91a9677..2422cef 100644
--- a/docs/RELEASING.md
+++ b/docs/RELEASING.md
@@ -24,6 +24,7 @@ npm publish needs 2FA.
    ```
 
 4. Create the GitHub release from the tag.
+5. For `am-i-hacked`, bump `AIH_VERSION` in `.github/workflows/gate.yml` to the new version so the security gate keeps running the latest stable release.
 
 `scripts/release.sh` refuses a private package, a version already on npm, and any
 `package.json` with lifecycle scripts (`prepare`, `prepack`, `postinstall` and the like) that