diff --git a/README.md b/README.md
index fd971a94b3b4086a562f5042db9381f47e2cab4e..72f947e9e6a2224181d7466c1c4445ba845a0001 100644
--- a/README.md
+++ b/README.md
@@ -59,11 +59,14 @@   `-I $(ASSETS)/scss`).
 
 ## Pinned dependencies (and why)
 
-- **`git.sr.ht/~sircmpwn/core-go` v0.0.0-20260520082310-fdb3662452dc** — this
-  exact pseudo-version matches the production instance's `core-go` submodule
-  commit (`fdb3662`). **Never upgrade it** (no bare `go get -u`, no `@latest`);
-  token validation, config, and crypto must behave identically to the rest of
-  the instance.
+- **`git.sr.ht/~sircmpwn/core-go`, replaced by the instance fork
+  `git.srht.bigb.es/~bigbes/core-go`** (pinned via a `replace` directive to the
+  fork's `master`, currently `c2c2f38` = upstream + instance patches). The fork
+  is what production actually runs; token validation, config, and crypto must
+  behave identically to the rest of the instance. **Never `go get -u` it and
+  never drop the replace**; to bump, pin the fork's new commit pseudo-version
+  in the `replace` line and re-run the test suite. Fetching the fork needs
+  `GOPRIVATE=git.srht.bigb.es` (skips the public module proxy/sumdb).
 - **`github.com/dolthub/dolt/go` v0.40.5-0.20260626152440-45335d44ad79** — a
   pseudo-version pinned to the commit tagged **v2.1.10** (`45335d44`), the dolt
   CLI version installed on the target host (`/opt/homebrew/bin/dolt`, v2.1.10).
diff --git a/go.mod b/go.mod
index e3059d986f4345bdc6ae409218d3e8d644fd9489..e2b7e34c7044b51c52015317997ea8d10f033465 100644
--- a/go.mod
+++ b/go.mod
@@ -163,3 +163,5 @@ 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/src-d/go-errors.v1 v1.0.0 // indirect
 )
+
+replace git.sr.ht/~sircmpwn/core-go => git.srht.bigb.es/~bigbes/core-go v0.0.0-20260718172441-c2c2f3848fa9
diff --git a/go.sum b/go.sum
index 661ce81dca3872ba908cead07a87b588fe02a4cb..1f362b33380df36475f2f4196ce1ca11ee6b4eef 100644
--- a/go.sum
+++ b/go.sum
@@ -34,6 +34,8 @@ git.sr.ht/~sircmpwn/getopt v1.0.0 h1:/pRHjO6/OCbBF4puqD98n6xtPEgE//oq5U8NXjP7ROc=
 git.sr.ht/~sircmpwn/getopt v1.0.0/go.mod h1:wMEGFFFNuPos7vHmWXfszqImLppbc0wEhh6JBfJIUgw=
 git.sr.ht/~sircmpwn/go-bare v0.0.0-20210406120253-ab86bc2846d9 h1:Ahny8Ud1LjVMMAlt8utUFKhhxJtwBAualvsbc/Sk7cE=
 git.sr.ht/~sircmpwn/go-bare v0.0.0-20210406120253-ab86bc2846d9/go.mod h1:BVJwbDfVjCjoFiKrhkei6NdGcZYpkDkdyCdg1ukytRA=
+git.srht.bigb.es/~bigbes/core-go v0.0.0-20260718172441-c2c2f3848fa9 h1:S/CncMS83NIBz+V5OlZEHlnrl1Yd5I4C7hDQ7lzQsTM=
+git.srht.bigb.es/~bigbes/core-go v0.0.0-20260718172441-c2c2f3848fa9/go.mod h1:JmathMemB+hBk1IgrMn6RuBGusd+fTg1s/X6rNVKXXU=
 github.com/99designs/gqlgen v0.17.36 h1:u/o/rv2SZ9s5280dyUOOrkpIIkr/7kITMXYD3rkJ9go=
 github.com/99designs/gqlgen v0.17.36/go.mod h1:6RdyY8puhCoWAQVr2qzF2OMVfudQzc8ACxzpzluoQm4=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=