diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6988357e9..377c81728 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,7 +18,7 @@
 - `test/preamble-hoist.test.ts` (new): tier 1 output is unchanged, and a tier 2+ SKILL.md with its `sections/preamble.md` applied holds exactly the pre-hoist preamble; the pointer opens the preamble, precedes the start command and names the shared file's id. `test/gen-skill-docs-checks.test.ts` checks that each host renders one shared preamble, beside every pointer and under the id the pointer names. `test/host-conformance.test.ts` checks that `setup --status` still finds a broken bare `sections/` pointer when a carved Claude skill's installed `sections/` is a directory symlink. A second `test/preamble-hoist.test.ts` case checks, on every host, tier and render option, that the pointer allows the skip only when the skill's own Read of the file is in context, never on the id alone.
 - Ship goldens regenerated. 27 paid-test touchfile keys gain `test/helpers/skill-startup.ts`, and every key that names `scripts/resolvers/preamble.ts` also names `scripts/resolvers/preamble-hoist.ts`, so a hoist change selects the same paid cases. One existing test-typecheck diagnostic fixed and its baseline lowered.
 - `test/skill-llm-eval.test.ts`: the `voice directive tone` judge reads review's Voice section through `readSkillEffective` (SKILL.md plus its shared preamble), because the section now lives in `review/sections/preamble.md`. The text it judges is byte-identical to main's; rubric and thresholds are unchanged.
-- `test/helpers/touchfiles-data.ts`: `ETHOS.md` is registered on the 41 paid cases whose touchfiles cover `plan-ceo-review` or `office-hours`, the two skills that tell the agent to read it, so an ETHOS.md change selects those cases instead of restoring the full gate. The unknown-dependency examples in `test/paid-pr-profile.test.ts` and `test/paid-free-boundary.test.ts` now use `SECURITY.md` and `LICENSE`, and the former checks that ETHOS.md maps to its reader cases.
+- `test/helpers/touchfiles-data.ts`: `ETHOS.md` is registered on the 41 paid cases whose touchfiles cover `plan-ceo-review` or `office-hours`, the two skills that tell the agent to read it, so an ETHOS.md change selects those cases instead of restoring the full gate. The unknown-dependency examples in `test/paid-pr-profile.test.ts`, `test/paid-free-boundary.test.ts` and `test/pr-dependencies.test.ts` now use `SECURITY.md` and `LICENSE`, and the first checks that ETHOS.md maps to its reader cases.
 
 ### Gate integrity
 - Raised: the ten parity caps above, by owner decision. No other threshold, budget, timeout, trial count, case kind or assertion weakened. The size floor and the growth ceiling in `test/skill-size-budget.test.ts` now measure SKILL.md plus its shared file, which is what a skill loads at startup.
diff --git a/test/pr-dependencies.test.ts b/test/pr-dependencies.test.ts
index a3ddcf73d..862a64bb4 100644
--- a/test/pr-dependencies.test.ts
+++ b/test/pr-dependencies.test.ts
@@ -179,7 +179,7 @@ describe('safe classification (A1-2)', () => {
       }
       expect(unknownFileLabel(file).label).toBe('full-gate input');
     }
-    expect(unknownFileLabel('ETHOS.md').label).toBe('real unknown dependency');
+    expect(unknownFileLabel('SECURITY.md').label).toBe('real unknown dependency');
   });
 });
 
@@ -264,7 +264,7 @@ describe('the fail-closed full-gate list', () => {
   });
 
   test('a file the derivation cannot place restores the full gate with its fix', () => {
-    for (const file of ['ETHOS.md', 'conductor.json']) {
+    for (const file of ['SECURITY.md', 'conductor.json']) {
       const result = computePaidCaseSelection({ profile: 'pr', env: {}, changedFiles: [file], packageVersionOnly: true });
       expect(result.coverage?.mode, file).toBe('full-fallback');
       const label = result.coverage!.unknownFileLabels[0]!;