diff --git a/PHASE2.md b/PHASE2.md
index 7115a21..557a90d 100644
--- a/PHASE2.md
+++ b/PHASE2.md
@@ -47,8 +47,9 @@ explicitly deferred by the maintainer, not silently skipped.
 
 ## Merge order
 
-1. Merge the control PR; maintainer publishes its reviewed version and moving
-   `v1` in **SNodeC/.github**. No tag is created by this implementation task.
+1. Merge the control PR and tag-reference follow-up; move the existing `v1.0`
+   tag to that reviewed control commit, as explicitly approved by the maintainer.
+   Callers use `@v1.0`; no `v1` tag is created and no `Book-*` tag is changed.
 2. Merge snode.c; require green default-branch Verify and a published `dev` SDK.
 3. Merge mqttsuite and AISuite; require green Verify, AISuite protocol validation
    and published SDKs. Stale/missing SDKs fail closed rather than rebuild silently.
@@ -98,3 +99,11 @@ Coordinated PRs: [control #2](https://github.com/SNodeC/.github/pull/2),
 [AISuite #60](https://github.com/SNodeC/AISuite/pull/60),
 [CodexUI #76](https://github.com/SNodeC/CodexUI/pull/76),
 [AutoTalk #6](https://github.com/SNodeC/AutoTalk/pull/6).
+
+## Workflow tag decision
+
+The maintainer explicitly requested moving the already existing tag in
+SNodeC/.github rather than creating `v1`. The API inventory contains only
+`v1.0`; it becomes the workflow reference in the canonical template and all
+five callers. This changes only the control-workflow design tag, never any
+product version or `Book-*` tag.
diff --git a/README.md b/README.md
index afe13fe..5a7b2e6 100644
--- a/README.md
+++ b/README.md
@@ -116,12 +116,13 @@ Stable version tags, secrets and package workflows are untouched.
 ### Coordinated rollout
 
 Merge the control workflow change first. The maintainer then publishes the
-reviewed shared-workflow version and moving `v1` alias in **SNodeC/.github**.
-The existing `v1.0` does not substitute for `@v1`, and predates these extensions.
+reviewed shared-workflow commit by moving the existing `v1.0` tag in
+**SNodeC/.github**. Callers and the canonical template use `@v1.0`; no new
+`v1` tag is created. The maintainer explicitly approved moving this existing tag.
 Merge snode.c next and wait for green default-branch CI plus its `dev` SDK.
 Then merge mqttsuite and AISuite; wait for AISuite's green CI/protocol check and
 SDK before CodexUI. AutoTalk can follow the control workflow independently.
-Caller PRs must not merge while `v1` or their development SDK dependencies are
+Caller PRs must not merge while `v1.0` lacks the shared workflows or SDK dependencies are
 missing. No duplicate old/native build jobs remain after their migration.
 
 Tests execute the actual inline workflow scripts, including ordered source
diff --git a/templates/ci.yml b/templates/ci.yml
index 84288e2..cf9c2e8 100644
--- a/templates/ci.yml
+++ b/templates/ci.yml
@@ -3,5 +3,5 @@ on: [push, pull_request, workflow_dispatch]
 permissions: { contents: read }
 jobs:
   snodec:
-    uses: SNodeC/.github/.github/workflows/verify.yml@v1
+    uses: SNodeC/.github/.github/workflows/verify.yml@v1.0
     secrets: inherit
diff --git a/tests/test_verify.py b/tests/test_verify.py
index 9317355..7fedd13 100644
--- a/tests/test_verify.py
+++ b/tests/test_verify.py
@@ -118,7 +118,7 @@ def test_template_exact_and_control_checks_independent(self):
         self.assertEqual((ROOT / "templates/ci.yml").read_text(),
                          "name: CI\non: [push, pull_request, workflow_dispatch]\n"
                          "permissions: { contents: read }\njobs:\n  snodec:\n"
-                         "    uses: SNodeC/.github/.github/workflows/verify.yml@v1\n"
+                         "    uses: SNodeC/.github/.github/workflows/verify.yml@v1.0\n"
                          "    secrets: inherit\n")
         ci = yaml.load((ROOT / ".github/workflows/ci.yml").read_text(), Loader=yaml.BaseLoader)
         steps = ci["jobs"]["control"]["steps"]