diff --git a/.github/workflows/publish-docker.yml b/.github/workflows/publish-docker.yml
index 8547c9a6..a32f1ea9 100644
--- a/.github/workflows/publish-docker.yml
+++ b/.github/workflows/publish-docker.yml
@@ -37,7 +37,7 @@ jobs:
 
       - name: Log in to GHCR
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 7afc09a3..db43f7bd 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with: { persist-credentials: false }
-      - uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+      - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
         with:
           min-severity: medium
           config: .github/zizmor.yml
diff --git a/drift-proposals/gemini-gemini-1.5-flash-deprecated-referenced.md b/drift-proposals/gemini-gemini-1.5-flash-deprecated-referenced.md
new file mode 100644
index 00000000..257880e7
--- /dev/null
+++ b/drift-proposals/gemini-gemini-1.5-flash-deprecated-referenced.md
@@ -0,0 +1,7 @@
+# Deprecated-but-still-referenced model family: gemini-1.5-flash
+
+Provider: gemini
+Detected: 2026-07-24
+Status: NEEDS HUMAN REVIEW
+
+This family no longer appears in the live /models listing, but aimock's own source still references it (builders, DEFAULT_MODELS, or fixtures). drift-sync never silently removes a still-referenced family.
diff --git a/drift-proposals/gemini-gemini-1.5-pro-deprecated-referenced.md b/drift-proposals/gemini-gemini-1.5-pro-deprecated-referenced.md
new file mode 100644
index 00000000..234fb984
--- /dev/null
+++ b/drift-proposals/gemini-gemini-1.5-pro-deprecated-referenced.md
@@ -0,0 +1,7 @@
+# Deprecated-but-still-referenced model family: gemini-1.5-pro
+
+Provider: gemini
+Detected: 2026-07-24
+Status: NEEDS HUMAN REVIEW
+
+This family no longer appears in the live /models listing, but aimock's own source still references it (builders, DEFAULT_MODELS, or fixtures). drift-sync never silently removes a still-referenced family.
diff --git a/src/__tests__/drift/logic-pin.test.ts b/src/__tests__/drift/logic-pin.test.ts
index 8e31bab9..bbff756e 100644
--- a/src/__tests__/drift/logic-pin.test.ts
+++ b/src/__tests__/drift/logic-pin.test.ts
@@ -200,11 +200,11 @@ const DATA_FROZEN: Record<string, { members: string[]; pin: string }> = {
   },
   "includeFamilies.anthropic": {
     members: [...includeFamilies.anthropic].sort(),
-    pin: "dbd8b4ef9afd50057143480d89db373886e7c19abe36ef9b4421456305ca2509",
+    pin: "ab79ff332fadeff93c2678ebe3e0af7a6280ce6f0deb4694228e316944dfeb74",
   },
   "includeFamilies.gemini": {
     members: [...includeFamilies.gemini].sort(),
-    pin: "4a9428b64ffcff0fbb79878d88ed993ffac53e43d64e26bcf5d86509626f593d",
+    pin: "c2e2c56b8f8d5fc56152b4633e7d3782e95b7eeb9bc123da71f00e884a54a743",
   },
   "excludeFamilies.openai": {
     members: [...excludeFamilies.openai].sort(),
@@ -216,7 +216,7 @@ const DATA_FROZEN: Record<string, { members: string[]; pin: string }> = {
   },
   "excludeFamilies.gemini": {
     members: [...excludeFamilies.gemini].sort(),
-    pin: "e3545138234ad782937f66760bef942fca7d4bd0934a87da30bf6e5816ba69b1",
+    pin: "c95dedab7588212bbba0bf9ab6434bfd43a449adbe7b35f81f48271ee849a9c2",
   },
 };
 
diff --git a/src/__tests__/drift/model-registry.ts b/src/__tests__/drift/model-registry.ts
index 5857a50c..56e20593 100644
--- a/src/__tests__/drift/model-registry.ts
+++ b/src/__tests__/drift/model-registry.ts
@@ -129,15 +129,14 @@ export const includeFamilies: Record<Provider, Set<string>> = {
     "claude-sonnet-4-5",
     "claude-sonnet-4-6",
     // Claude 5 families (text chat)
+    "claude-opus-5",
     "claude-sonnet-5",
     // claude-fable-5 is included ahead of a recorded fixture (intended — mirrors
     // the forward-looking rationale for the exclude-by-rule patterns above).
     "claude-fable-5",
   ]),
   gemini: familySet("gemini", [
-    // Gemini 1.5 / 2.0 / 2.5 text families
-    "gemini-1.5-pro",
-    "gemini-1.5-flash",
+    // Gemini 2.0 / 2.5 text families
     "gemini-2.0-flash",
     "gemini-2.5-flash",
     "gemini-2.5-pro",
@@ -226,6 +225,14 @@ export const excludeFamilies: Record<Provider, Set<string>> = {
     // Retired / legacy specialty
     "gemini-pro",
     "aqa",
+    // Gemini 1.5 retired upstream 2026-07 (absent from the live /models listing)
+    // but aimock still mocks it for clients pinned to older SDKs, and
+    // `isReasoningModel()` must keep answering false for it (model-utils.ts's
+    // NONREASONING_FAMILIES). Same treatment as gemini-pro above: still
+    // referenced + still mocked, just not counted as text-generation drift.
+    // See drift-proposals/gemini-gemini-1.5-{pro,flash}-deprecated-referenced.md.
+    "gemini-1.5-pro",
+    "gemini-1.5-flash",
     // Embeddings (non-text-generation)
     "text-embedding-004",
     "gemini-embedding",