diff --git a/actions/setup/js/work_queue_control_adapter_checks.cjs b/actions/setup/js/work_queue_control_adapter_checks.cjs
index 6232b966f25..60112a0176c 100644
--- a/actions/setup/js/work_queue_control_adapter_checks.cjs
+++ b/actions/setup/js/work_queue_control_adapter_checks.cjs
@@ -757,7 +757,7 @@ async function verifyCompiledDispatchIdentity(input) {
             assert.equal(dispatch.sender.principal, "11");
             assert.equal(dispatch.sender.run_attempt, 2);
             assert.equal(parameters.ref, REF);
-            assert.equal(parameters.workflow_id, WORKFLOW);
+            assert.equal(parameters.workflow_id, path.posix.basename(WORKFLOW));
             assert.notEqual(parameters.ref, fixture.dispatcherContext.sha);
             return { status: 200, data: { workflow_run_id: "42", run_url: "https://api.github.com/repos/owner/repo/actions/runs/42", html_url: "https://github.com/owner/repo/actions/runs/42" } };
           },
diff --git a/pkg/workflow/work_queue_compilation_integration_test.go b/pkg/workflow/work_queue_compilation_integration_test.go
index 7e13bfd8118..1e508e77c9b 100644
--- a/pkg/workflow/work_queue_compilation_integration_test.go
+++ b/pkg/workflow/work_queue_compilation_integration_test.go
@@ -92,7 +92,8 @@ func TestWorkQueueDispatchCredentialActualCompilation(t *testing.T) {
 			} else {
 				require.Equal(t, -1, mint)
 			}
-			require.NotContains(t, string(content), "GH_AW_WORK_QUEUE_POLICY:")
+			require.Contains(t, string(content), "GH_AW_WORK_QUEUE_POLICY:")
+			require.Contains(t, string(content), `\"authorization\":\"aw\"`)
 		})
 	}
 }
@@ -195,7 +196,9 @@ Compile each work-queue workflow phase.
 func TestWorkQueueNamedProfileCompilation(t *testing.T) {
 	dir := testutil.TempDir(t, "work-queue-named-profile-")
 	path := filepath.Join(dir, "worker.md")
+	// Keep coverage of legacy explicit profiles without repository-level scheduling.
 	require.NoError(t, os.WriteFile(path, []byte(`---
+strict: false
 on: workflow_dispatch
 engine: claude
 tools:
@@ -221,6 +224,7 @@ safe-outputs:
 Use the explicitly approved profile without an implicit fallback worker.
 `), 0o600))
 	compiler := NewCompiler(WithVersion("integration"))
+	compiler.gitRoot = dir
 	compiler.SetApprove(true)
 	require.NoError(t, compiler.CompileWorkflow(path))
 	content, err := os.ReadFile(filepath.Join(dir, "worker.lock.yml"))
@@ -569,7 +573,8 @@ Read the queue and dispatch an available Work identity.
 	require.Contains(t, string(compiled), `work_queue_workflows`)
 	require.Contains(t, string(compiled), `work_queue`)
 	require.NotContains(t, string(compiled), "WORK_QUEUE_HMAC_SECRET")
-	require.NotContains(t, string(compiled), "GH_AW_WORK_QUEUE_POLICY:")
+	require.Contains(t, string(compiled), "GH_AW_WORK_QUEUE_POLICY:")
+	require.Contains(t, string(compiled), `\"authorization\":\"aw\"`)
 	inputs, err := extractWorkflowDispatchInputs(filepath.Join(workflowsDir, "dispatcher.lock.yml"))
 	require.NoError(t, err)
 	require.NotContains(t, inputs, WorkQueueClaimInputName)
diff --git a/pkg/workflow/work_queue_dispatch_identity_integration_test.go b/pkg/workflow/work_queue_dispatch_identity_integration_test.go
index 57bca8de118..574eaef60b1 100644
--- a/pkg/workflow/work_queue_dispatch_identity_integration_test.go
+++ b/pkg/workflow/work_queue_dispatch_identity_integration_test.go
@@ -33,7 +33,9 @@ func TestWorkQueueCompiledPolicyAndLaunchIdentity(t *testing.T) {
 			dir := filepath.Join(testutil.TempDir(t, "compiled-queue-identity-"), ".github", "workflows")
 			require.NoError(t, os.MkdirAll(dir, 0o700))
 			require.NoError(t, os.WriteFile(filepath.Join(dir, "worker.md"), []byte("---\non: workflow_dispatch\ntools:\n  work-queue:\n    worker: true\n---\nProcess the original immutable assignment.\n"), 0o600))
+			// Explicit principal policies remain supported only in legacy non-strict mode.
 			source := fmt.Sprintf(`---
+strict: false
 on: workflow_dispatch
 engine: claude
 tools:
@@ -65,6 +67,7 @@ Dispatch only approved workers using the protected launch credential.
 			filename := filepath.Join(dir, "dispatcher.md")
 			require.NoError(t, os.WriteFile(filename, []byte(source), 0o600))
 			compiler := NewCompiler(WithVersion("integration"))
+			compiler.gitRoot = filepath.Dir(filepath.Dir(dir))
 			compiler.SetApprove(true)
 			require.NoError(t, compiler.CompileWorkflow(filename))
 			content, err := os.ReadFile(filepath.Join(dir, "dispatcher.lock.yml"))
diff --git a/pkg/workflow/work_queue_persistent_memory_integration_test.go b/pkg/workflow/work_queue_persistent_memory_integration_test.go
index e38999ceaa8..2192c2eb715 100644
--- a/pkg/workflow/work_queue_persistent_memory_integration_test.go
+++ b/pkg/workflow/work_queue_persistent_memory_integration_test.go
@@ -99,6 +99,9 @@ func TestWorkQueueFactoryDocumentationExcerptsCompile(t *testing.T) {
 			require.NoError(t, err)
 			directory := filepath.Join(testutil.TempDir(t, "work-queue-factory-docs-"), ".github", "workflows")
 			require.NoError(t, os.MkdirAll(directory, 0o700))
+			shared, err := filepath.Abs("../../.github/workflows/shared")
+			require.NoError(t, err)
+			require.NoError(t, os.Symlink(shared, filepath.Join(directory, "shared")))
 			for _, worker := range []string{"eslint-miner", "eslint-refiner", "eslint-monster"} {
 				for _, extension := range []string{".md", ".lock.yml"} {
 					target, err := filepath.Abs("../../.github/workflows/" + worker + extension)