diff --git a/modules/agent-box.nix b/modules/agent-box.nix
index afa0dd5..d38a8c0 100644
--- a/modules/agent-box.nix
+++ b/modules/agent-box.nix
@@ -2103,7 +2103,7 @@ in
       };
       rev = lib.mkOption {
         type = lib.types.str;
-        default = "efa253166074789ece9709e4a1e3a4be58801166";
+        default = "aec22b5878b19dca12de5c954e86302cd6c7bdd8";
         description = ''
           Pinned local-channels commit whose local-webhook/webhook.py the
           receiver daemon and the agent-box-webhook CLI run. Claude sessions
@@ -2117,7 +2117,7 @@ in
         # builtins.fetchurl hash of local-webhook/webhook.py at `rev`:
         #   nix-prefetch-url https://raw.githubusercontent.com/<repo>/<rev>/local-webhook/webhook.py
         # then `nix hash convert --hash-algo sha256 --to sri <base32>`.
-        default = "sha256-qHVF398YAwiIqbYG2/HY+hVzY4HF4saiasdZHAXngIM=";
+        default = "sha256-fZKy5jCsn3bom9F4E3dqW7N7x9ky+IM4NXFzLLSBOtU=";
         description = "builtins.fetchurl hash of the pinned local-webhook/webhook.py.";
       };
     };
diff --git a/modules/agent-box.nix.in b/modules/agent-box.nix.in
index 65e6842..751ee4a 100644
--- a/modules/agent-box.nix.in
+++ b/modules/agent-box.nix.in
@@ -2099,7 +2099,7 @@ in
       };
       rev = lib.mkOption {
         type = lib.types.str;
-        default = "efa253166074789ece9709e4a1e3a4be58801166";
+        default = "aec22b5878b19dca12de5c954e86302cd6c7bdd8";
         description = ''
           Pinned local-channels commit whose local-webhook/webhook.py the
           receiver daemon and the agent-box-webhook CLI run. Claude sessions
@@ -2113,7 +2113,7 @@ in
         # builtins.fetchurl hash of local-webhook/webhook.py at `rev`:
         #   nix-prefetch-url https://raw.githubusercontent.com/<repo>/<rev>/local-webhook/webhook.py
         # then `nix hash convert --hash-algo sha256 --to sri <base32>`.
-        default = "sha256-qHVF398YAwiIqbYG2/HY+hVzY4HF4saiasdZHAXngIM=";
+        default = "sha256-fZKy5jCsn3bom9F4E3dqW7N7x9ky+IM4NXFzLLSBOtU=";
         description = "builtins.fetchurl hash of the pinned local-webhook/webhook.py.";
       };
     };
diff --git a/tests/webhook.nix b/tests/webhook.nix
index 248e2b3..60d6728 100644
--- a/tests/webhook.nix
+++ b/tests/webhook.nix
@@ -363,6 +363,40 @@
         " agent-box-webhook unsubscribe defangdevs/agent-box"
     )
 
+    # --- dispatch brake: a green run is not news (local-channels 0.10.1) -----
+    # Nobody owns the topic now and this sender is on no ignore list, so the
+    # OUTCOME is the only thing that can hold the spawn back. Pinned webhook.py
+    # before 0.10.1 read the outcome only to decide whether a CI event could
+    # override an ignored sender, and started a session per green build: one
+    # merge to master cost four hook-* sessions that each concluded "nothing to
+    # do", with the four-session cap then standing between a real failure and
+    # its triage.
+    client.succeed(
+        "cat > /tmp/green.json <<'EOF'\n"
+        '{"action":"completed","workflow_run":{"name":"CI","conclusion":"success",'
+        '"head_branch":"master","html_url":"https://box.test/run/2"},'
+        '"repository":{"full_name":"defangdevs/agent-box"},"sender":{"login":"someone"}}\n'
+        "EOF"
+    )
+    sig_green = client.succeed(
+        f"openssl dgst -sha256 -hmac {secret} -r /tmp/green.json | cut -d' ' -f1"
+    ).strip()
+    client.succeed(
+        f"{curl} -o /dev/null -w '%{{http_code}}' -X POST"
+        " -H 'content-type: application/json' -H 'x-github-event: workflow_run'"
+        " -H 'x-github-delivery: test-green'"
+        f" -H 'x-hub-signature-256: sha256={sig_green}' --data-binary @/tmp/green.json"
+        " https://box.test/agent/webhook/github | grep -x 200"
+    )
+    machine.wait_until_succeeds(
+        "journalctl -u agent-box-webhook-agent --no-pager | grep -q 'no failing outcome'",
+        timeout=30,
+    )
+    machine.fail(
+        "jq -e '.sessions | keys | map(select(startswith(\"hook-\"))) | length > 0'"
+        " /home/agent/.config/agent-box/sessions.json"
+    )
+
     # A signed delivery on the watched repo → a fresh hook-* session appears in
     # sessions.json, primed with the framed event text plus the trusted
     # preamble, and the supervisor starts it as a real tmux session.