diff --git a/.github/guid-index.json b/.github/guid-index.json
index 2507c04d..ced0d64a 100644
--- a/.github/guid-index.json
+++ b/.github/guid-index.json
@@ -979,7 +979,7 @@
     "path": ".github/workflows/reusable-ci.yml",
     "guid": "reusable-ci-2025-09-24-core-workflow",
     "title": "Reusable CI Workflow",
-    "version": "1.19.1",
+    "version": "1.19.2",
     "header_path": ".github/workflows/reusable-ci.yml",
     "path_mismatch": false
   },
diff --git a/.github/workflows/reusable-ci.yml b/.github/workflows/reusable-ci.yml
index 0a6dad66..b5cea650 100644
--- a/.github/workflows/reusable-ci.yml
+++ b/.github/workflows/reusable-ci.yml
@@ -1,7 +1,7 @@
 # file: .github/workflows/reusable-ci.yml
-# version: 1.19.1
+# version: 1.19.2
 # guid: reusable-ci-2025-09-24-core-workflow
-# last-edited: 2026-10-20
+# last-edited: 2026-10-21
 
 name: Reusable CI Workflow
 
@@ -621,7 +621,7 @@ jobs:
             # (e04c222, 2026-03-28) predated the rust-* commands added in 767acd4
             # (2026-05-27), so every repo without the ref file failed Rust CI with
             # "Unknown command: rust-build".
-            ref="1f0d70e877c89a21a597db5a24e2775d3015ddda"
+            ref="861d4e83ccf918c9354a2d5f5685068f655cdf58"
           fi
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
@@ -739,7 +739,7 @@ jobs:
           if [ -f .github/ghcommon-ref.txt ]; then
             ref="$(cat .github/ghcommon-ref.txt)"
           else
-            ref="1f0d70e877c89a21a597db5a24e2775d3015ddda"
+            ref="861d4e83ccf918c9354a2d5f5685068f655cdf58"
           fi
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
@@ -807,7 +807,7 @@ jobs:
           if [ -f .github/ghcommon-ref.txt ]; then
             ref="$(cat .github/ghcommon-ref.txt)"
           else
-            ref="1f0d70e877c89a21a597db5a24e2775d3015ddda"
+            ref="861d4e83ccf918c9354a2d5f5685068f655cdf58"
           fi
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
@@ -902,7 +902,7 @@ jobs:
           if [ -f .github/ghcommon-ref.txt ]; then
             ref="$(cat .github/ghcommon-ref.txt)"
           else
-            ref="1f0d70e877c89a21a597db5a24e2775d3015ddda"
+            ref="861d4e83ccf918c9354a2d5f5685068f655cdf58"
           fi
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
@@ -1108,7 +1108,7 @@ jobs:
           if [ -f .github/ghcommon-ref.txt ]; then
             ref="$(cat .github/ghcommon-ref.txt)"
           else
-            ref="1f0d70e877c89a21a597db5a24e2775d3015ddda"
+            ref="861d4e83ccf918c9354a2d5f5685068f655cdf58"
           fi
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
diff --git a/changelog.d/20261021-fallback-ref-ruff-pin.md b/changelog.d/20261021-fallback-ref-ruff-pin.md
new file mode 100644
index 00000000..34e21e45
--- /dev/null
+++ b/changelog.d/20261021-fallback-ref-ruff-pin.md
@@ -0,0 +1,5 @@
+### Changed
+
+- `reusable-ci.yml`: the fallback ghcommon script ref (used when a caller has no
+  `.github/ghcommon-ref.txt`) now points at `861d4e83`, so callers without a pin
+  get the ruff 0.17.0 Python lint from #378.