diff --git a/.github/workflows/sovereign-ci.yml b/.github/workflows/sovereign-ci.yml
index 3ded0d9..e834630 100644
--- a/.github/workflows/sovereign-ci.yml
+++ b/.github/workflows/sovereign-ci.yml
@@ -66,6 +66,14 @@ on:
         required: false
         default: 'always'
         type: string
+      advisories_diff_only:
+        description: >-
+          true: the caller judges advisories itself, as a diff against its base (aprender
+          PMAT-5792), so the plain `cargo deny check advisories` in `lint` and `cargo audit`
+          in `security` are skipped; licenses and sources still run. Default false: unchanged.
+        required: false
+        default: false
+        type: boolean
       run_benchmarks:
         description: 'Run criterion benchmarks (slow, use for nightly only)'
         required: false
@@ -618,6 +626,7 @@ jobs:
         # the stricter check.
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          SOV_ADVISORIES_DIFF_ONLY: ${{ inputs.advisories_diff_only }}
         run: |
           # forjar#422: the advisory-db clone is an anonymous git-over-HTTPS
           # fetch of a public repo, and GitHub answers the fleet's IP with 401
@@ -635,7 +644,13 @@ jobs:
           GIT_CONFIG_VALUE_0="AUTHORIZATION: basic $(printf 'x-access-token:%s' "$GITHUB_TOKEN" | base64 | tr -d '\n')"
           export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0 GIT_TERMINAL_PROMPT=0
           if [ -f deny.toml ]; then
-            cargo deny check advisories licenses sources
+            # advisories_diff_only: true: the caller judges advisories as a diff against its
+            # base (aprender PMAT-5792), so a main-resident advisory must not stop its PRs.
+            if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = true ]; then
+              cargo deny check licenses sources
+            else
+              cargo deny check advisories licenses sources
+            fi
           else
             echo "::warning::No deny.toml — skipping supply chain audit"
           fi
@@ -1487,6 +1502,7 @@ jobs:
       - name: Audit
         env:
           GITHUB_TOKEN: ${{ github.token }}
+          SOV_ADVISORIES_DIFF_ONLY: ${{ inputs.advisories_diff_only }}
         run: |
           # forjar#422: same throttle as the cargo-deny step — authenticate the
           # advisory-db fetch with the job's own token via a url rewrite.
@@ -1527,7 +1543,11 @@ jobs:
             fi
           fi
 
-          cargo audit $IGNORE_FLAGS
+          if [ "${SOV_ADVISORIES_DIFF_ONLY:-}" = true ]; then
+            echo "cargo audit skipped: the caller's diff gate is the scanner of record (advisories_diff_only: true)"
+          else
+            cargo audit $IGNORE_FLAGS
+          fi
       # Symmetry with the container jobs (paiml/.github#42): every clean-room
       # job both tolerates poison on entry and refuses to leave any on exit,
       # so the invariant is uniform and greppable rather than per-job folklore.