diff --git a/.github/workflows/pr-ci.yml b/.github/workflows/pr-ci.yml
index 0b72ab4555f..512163ebfeb 100644
--- a/.github/workflows/pr-ci.yml
+++ b/.github/workflows/pr-ci.yml
@@ -37,6 +37,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v5
+        with:
+          persist-credentials: false
 
       - name: Detect changed paths
         id: filter
@@ -105,6 +107,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Cache pnpm store
         id: pnpm-cache
@@ -153,6 +156,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Cache pnpm store
         id: pnpm-cache
@@ -218,7 +222,7 @@ jobs:
     if: needs.changes.outputs.playwright == 'true'
     runs-on: ubuntu-22.04
     container:
-      image: ghcr.io/tinyhumansai/openhuman_ci:latest
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     timeout-minutes: 30
     env:
       CARGO_INCREMENTAL: "0"
@@ -324,6 +328,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Cache pnpm store
         id: pnpm-cache
@@ -526,7 +531,7 @@ jobs:
     if: always() && needs.changes.outputs['rust-core'] == 'true' && needs['rust-quality'].result == 'success'
     runs-on: ubuntu-22.04
     container:
-      image: ghcr.io/tinyhumansai/openhuman_ci:latest
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     timeout-minutes: 30
     env:
       CARGO_INCREMENTAL: "0"
@@ -589,7 +594,8 @@ jobs:
 
   playwright-e2e:
     name: E2E (Playwright / web lane ${{ matrix.shard }}/4)
-    needs: [changes, frontend-quality, rust-quality, build-playwright-e2e-artifact]
+    needs:
+      [changes, frontend-quality, rust-quality, build-playwright-e2e-artifact]
     if: |
       always() &&
       needs.changes.outputs.playwright == 'true' &&
@@ -598,7 +604,7 @@ jobs:
       contains(fromJSON('["success", "skipped"]'), needs['rust-quality'].result)
     runs-on: ubuntu-22.04
     container:
-      image: ghcr.io/tinyhumansai/openhuman_ci:latest
+      image: ghcr.io/tinyhumansai/openhuman_ci:rust-1.93.0
     timeout-minutes: 30
     # Sharded 4 ways: each shard is a separate runner that boots its OWN backend
     # stack (mock + core + web on fixed ports) and runs playwright --shard=i/4.
@@ -742,6 +748,7 @@ jobs:
         uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Resolve coverage compare ref
         if: needs.changes.outputs.coverage == 'true'
diff --git a/app/test/playwright/specs/harness-composio-tool-flow.spec.ts b/app/test/playwright/specs/harness-composio-tool-flow.spec.ts
index f87d069e5d5..f7da2a59fa8 100644
--- a/app/test/playwright/specs/harness-composio-tool-flow.spec.ts
+++ b/app/test/playwright/specs/harness-composio-tool-flow.spec.ts
@@ -245,7 +245,9 @@ test.describe('Harness - Composio tool-call prompt flow', () => {
 
     await sendMessage(page, 'check my email inbox please');
     await expect(page.getByText(CANARY).first()).toBeVisible({ timeout: 60_000 });
-    await expect(page.getByText(/unable to fetch your emails/i)).toBeVisible();
+    await expect(
+      page.getByTestId('agent-message-text').filter({ hasText: /unable to fetch your emails/i })
+    ).toBeVisible();
   });
 
   test('linear create issue flow confirms creation in the final reply', async ({ page }) => {
diff --git a/app/test/playwright/specs/harness-cron-prompt-flow.spec.ts b/app/test/playwright/specs/harness-cron-prompt-flow.spec.ts
index 8e37e02e12a..09f098217a6 100644
--- a/app/test/playwright/specs/harness-cron-prompt-flow.spec.ts
+++ b/app/test/playwright/specs/harness-cron-prompt-flow.spec.ts
@@ -193,7 +193,11 @@ test.describe('Harness - Cron prompt-flow', () => {
 
     await sendMessage(page, 'change my morning reminder to 8am');
     await expect(page.getByText(CANARY).first()).toBeVisible({ timeout: 60_000 });
-    await expect(page.getByText(/changed your morning reminder to 8am/i)).toBeVisible();
+    await expect(
+      page
+        .getByTestId('agent-message-text')
+        .filter({ hasText: /changed your morning reminder to 8am/i })
+    ).toBeVisible();
   });
 
   test('delete flow yields a final reply', async ({ page }) => {