diff --git a/.github/workflows/codeql-pr.yml b/.github/workflows/codeql-pr.yml
index 240e7139d..b5c57a829 100644
--- a/.github/workflows/codeql-pr.yml
+++ b/.github/workflows/codeql-pr.yml
@@ -194,7 +194,9 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-          ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
+          # GitHub can omit the synthetic merge ref for stacked/non-default-base PRs;
+          # the event's merge SHA is the exact merge-result identity we must analyze.
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
@@ -208,7 +210,7 @@ jobs:
           category: "/language:${{ matrix.language }}-merge"
           upload: false
           output: codeql-results-merge
-          ref: ${{ format('refs/pull/{0}/merge', github.event.pull_request.number) }}
+          ref: ${{ github.event.pull_request.merge_commit_sha }}
           sha: ${{ github.event.pull_request.merge_commit_sha }}
 
       - name: Enforce CodeQL Medium+ SARIF gate
diff --git a/tests/test_codeql_pr_workflow_contract.py b/tests/test_codeql_pr_workflow_contract.py
index 813385b23..7a23c99da 100644
--- a/tests/test_codeql_pr_workflow_contract.py
+++ b/tests/test_codeql_pr_workflow_contract.py
@@ -36,7 +36,8 @@ def test_codeql_pr_workflow_gates_head_and_merge_sarif_locally() -> None:
     assert "github.event.pull_request.head.sha" in workflow
     assert "github.event.pull_request.merge_commit_sha" in workflow
     assert "refs/pull/{0}/head" in workflow
-    assert "refs/pull/{0}/merge" in workflow
+    assert workflow.count("ref: ${{ github.event.pull_request.merge_commit_sha }}") == 2
+    assert "refs/pull/{0}/merge" not in workflow
     assert workflow.count("security-events: read") == 2
     assert "security-events: write" not in workflow