diff --git a/.gitea/workflows/adversarial-review.yml b/.gitea/workflows/adversarial-review.yml
index 4c8e428..03d69a3 100644
--- a/.gitea/workflows/adversarial-review.yml
+++ b/.gitea/workflows/adversarial-review.yml
@@ -44,7 +44,7 @@ jobs:
     # 3 cloud models, all concurrent, 3-lens suite. ~12 min typical.
     timeout-minutes: 30
     steps:
-      - uses: docker://gitea.stevedudenhoeffer.com/steve/gadfly:sha-d0de034
+      - uses: docker://gitea.stevedudenhoeffer.com/steve/gadfly:sha-d7f364d
         env:
           GITEA_API: ${{ github.server_url }}/api/v1/repos/${{ github.repository }}
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
@@ -69,6 +69,12 @@ jobs:
           GADFLY_MAX_STEPS: "14"
           # Allow-list for the comment trigger (mirrors the job-level if: guard).
           GADFLY_ALLOWED_USERS: "steve,fizi,dazed"
+          # --- findings telemetry: POST runs + findings to the gadfly-reports store ---
+          # Advisory & off unless GADFLY_FINDINGS_URL is set; failures only log to
+          # stderr and never affect the review. GADFLY_REPO / GADFLY_PR are derived
+          # in-container; the URL + token are user-scope secrets.
+          GADFLY_FINDINGS_URL: ${{ secrets.GADFLY_FINDINGS_URL }}
+          GADFLY_FINDINGS_TOKEN: ${{ secrets.GADFLY_FINDINGS_TOKEN }}
           # --- event context (leave as-is) ---
           EVENT_NAME: ${{ github.event_name }}
           PR: ${{ github.event.pull_request.number || github.event.issue.number || github.event.inputs.pr_number }}