diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3dac91..bdfe60d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,11 @@ review can tell which standard a project was built from.
 
 ## Unreleased
 
+- **Template test:** `test_approval_node_reasks_instead_of_applying_unknown_ids` no longer asserts that a re-asked HITL card
+  keeps its id. langgraph 1.2.20 issues a new interrupt id there (1.2.18 kept it); the documented contract (every card has its
+  own id, the client echoes the one it was given) is unchanged and the test still resumes with the id it receives. This turned the
+  CI `upgrade` job red on 2026-11-09: it re-locks an old project, which picked up langgraph 1.2.20, while the shipped
+  `uv.lock` still pins 1.2.18.
 - **Docs re-read (2026-11): skills corrected where the AgentBase docs say otherwise** (docs-only; no template code changed).
   Runtime Inbound Auth `IAM Permissions` / `JWT` **strips `Authorization` before the container** (only *No authorization*
   forwards it) and the Console now defaults a new Runtime to IAM: `agentbase-build-deploy`, `-auth`, `-web`, `-frontend` and
diff --git a/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py b/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py
index d934ff2..0c8761c 100644
--- a/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py
+++ b/skills/agentbase-build-hitl/assets/backend/tests/test_hitl.py
@@ -253,10 +253,14 @@ async def test_approval_node_reasks_instead_of_applying_unknown_ids(fake_llm, mo
     _two_cards(fake_llm)
     await service.handle({"message": "remember x then y"}, ctx("hitl-r3"))
     card2 = (await service.handle(_approve("c1"), ctx("hitl-r3")))["interrupt"]
+    assert [tc["id"] for tc in card2["tool_calls"]] == ["c2"]
     check = service.stale_decision_ids
     monkeypatch.setattr(service, "stale_decision_ids", lambda *a: set())
     again = await service.handle(_approve("c1"), ctx("hitl-r3"))
-    assert again["status"] == "interrupted" and again["interrupt"]["id"] == card2["id"]
+    assert again["status"] == "interrupted"
+    # the re-asked card keeps its id (langgraph <= 1.2.18) or gets a new one (>= 1.2.20): the contract is only that the
+    # client echoes the id it was given, which the last resume below does
+    assert isinstance(again["interrupt"]["id"], str) and again["interrupt"]["id"]
     assert [tc["id"] for tc in again["interrupt"]["tool_calls"]] == ["c2"]
     monkeypatch.setattr(service, "stale_decision_ids", check)
     done = await service.handle(_approve("c2", again["interrupt"]["id"]), ctx("hitl-r3"))