diff --git a/.claude/worktrees/qwen b/.claude/worktrees/qwen
new file mode 160000
index 0000000..d8b023e
--- /dev/null
+++ b/.claude/worktrees/qwen
@@ -0,0 +1 @@
+Subproject commit d8b023efd673835f4f9f45f3290df0e37c8f1430
diff --git a/.gitea/workflows/review-reusable.yml b/.gitea/workflows/review-reusable.yml
index 5d38d88..383ffe9 100644
--- a/.gitea/workflows/review-reusable.yml
+++ b/.gitea/workflows/review-reusable.yml
@@ -63,7 +63,7 @@ on:
       max_steps:                 { type: string, default: "14" }   # GADFLY_MAX_STEPS
       worker_model:              { type: string, default: "" }   # GADFLY_WORKER_MODEL
       allowed_users:             { type: string, default: "" }   # GADFLY_ALLOWED_USERS (consumer-specific; set in your stub)
-      reviewer_tag:              { type: string, default: "" }   # reviewer image tag (e.g. "sha-b37cd09") — empty falls back to user var GADFLY_REVIEWER_TAG, then the pin baked into the container: line
+      reviewer_tag:              { type: string, default: "" }   # reviewer image tag (e.g. "sha-b850e35") — empty falls back to user var GADFLY_REVIEWER_TAG, then the pin baked into the container: line
       # Gitea >= 1.27 does not propagate the CALLER's workflow_dispatch inputs into a
       # called workflow's github.event, so a manual "review PR #N" dispatch arrived
       # here with an empty PR and died at the entrypoint's "PR required" check. The
@@ -125,11 +125,14 @@ jobs:
     # the owner's variables redirects every consumer's reviewer image (same blast
     # radius as editing this file, but without a commit trail).
     #
-    # Fallback pin: sha-b37cd09 — the provider-wide lens budget (PR #27) on top of
-    # the opencode CLI engine (PR #26) and the Gitea >= 1.27 workflow_call
-    # reclassification. Keep it current-ish when touching this file anyway.
+    # Fallback pin: sha-b850e35 — adds the qwen/kimi built-ins (PR #30: majordomo
+    # bumped for the qwen provider, a credential pre-flight that names the missing
+    # variable, and one no-cross-vendor-fallback rule so a keyless kimi/qwen
+    # endpoint can never send an OpenAI key to another vendor) on top of the
+    # provider-wide lens budget (PR #27). Keep it current-ish when touching this
+    # file anyway.
     container:
-      image: gitea.stevedudenhoeffer.com/steve/gadfly:${{ inputs.reviewer_tag || vars.GADFLY_REVIEWER_TAG || 'sha-b37cd09' }}
+      image: gitea.stevedudenhoeffer.com/steve/gadfly:${{ inputs.reviewer_tag || vars.GADFLY_REVIEWER_TAG || 'sha-b850e35' }}
     steps:
       - name: Run the gadfly reviewer
         run: /entrypoint.sh