diff --git a/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh b/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh
index 73a1fb1..7917eec 100755
--- a/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh
+++ b/AINative_OKR_CASAN5/.specify/scripts/bash/tool-audit-lib.sh
@@ -52,8 +52,11 @@ PY
   if [[ ! -f "$priv" ]]; then
     openssl genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "$priv" 2>/dev/null
     chmod 600 "$priv"
-    openssl rsa -in "$priv" -pubout -out "$pub" 2>/dev/null
   fi
+  # Always re-export the matching public key so a persisted off-repo private key
+  # never drifts out of sync with a freshly checked-out audit-public.pem on CI
+  # runners (see governance-check.sh for the full rationale).
+  openssl rsa -in "$priv" -pubout -out "$pub" 2>/dev/null || true
   printf '%s' "$head" > "$audit_dir/tool-calls-head.txt"
   openssl dgst -sha256 -sign "$priv" -out "$audit_dir/tool-calls-head.sig" "$audit_dir/tool-calls-head.txt" 2>/dev/null || true
 }