diff --git a/.github/workflows/dependabot-catalog-convergence.yml b/.github/workflows/dependabot-catalog-convergence.yml
index 4f61d97..b6c928d 100644
--- a/.github/workflows/dependabot-catalog-convergence.yml
+++ b/.github/workflows/dependabot-catalog-convergence.yml
@@ -79,8 +79,28 @@ jobs:
           ref: ${{ github.event.workflow_run.head_branch }}
           persist-credentials: true
           path: candidate
+      - name: Set up Python
+        id: python
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+        with:
+          python-version: "3.13"
+          update-environment: false
+      - name: Set up uv
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
+        with:
+          version: 0.11.30
+          enable-cache: false
+      - name: Build trusted tool environment
+        env:
+          PYTHON_PATH: ${{ steps.python.outputs.python-path }}
+        run: |
+          "$PYTHON_PATH" -I -B -m venv --copies trusted/.venv
+          uv pip install --python trusted/.venv/bin/python --require-hashes -r trusted/requirements-ci.txt
       - name: Synchronize derived action declarations
-        run: python3 -I trusted/scripts/sync_action_catalog.py --root candidate --catalog-only
+        run: >-
+          trusted/.venv/bin/python -I -B
+          trusted/scripts/check_python_execution_contract.py
+          --launch sync_action_catalog.py -- --root candidate --catalog-only
       - name: Commit converged declarations
         id: commit
         working-directory: candidate
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 504f156..eb9390a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,14 @@ The project follows Semantic Versioning.
 
 ## [Unreleased]
 
+### Fixed
+
+- `dependabot-catalog-convergence` now builds the trusted tool environment and
+  launches `sync_action_catalog.py` through the execution-contract launcher.
+  The bare `python3 -I` invocation could not resolve the `ci_workflows_tools`
+  verified-file-spec package, so every convergence run since the sibling-import
+  migration failed with `ModuleNotFoundError`.
+
 ## [0.1.25] - 2026-09-21
 
 - **Refuse `./action` refs inside `workflow_call` workflows.** `./` in a
diff --git a/catalog/tools.yml b/catalog/tools.yml
index fe700c2..f4e67ad 100644
--- a/catalog/tools.yml
+++ b/catalog/tools.yml
@@ -245,6 +245,7 @@ tools:
       - .github/workflows/benchmark.yml
       - .github/workflows/ci.yml
       - .github/workflows/cross-platform-smoke.yml
+      - .github/workflows/dependabot-catalog-convergence.yml
       - .github/workflows/maintenance.yml
       - .github/workflows/mutation-testing.yml
       - .github/workflows/private-static.yml
@@ -512,6 +513,7 @@ tools:
     pin: "astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4"
     used_by:
       - .github/workflows/ci.yml
+      - .github/workflows/dependabot-catalog-convergence.yml
       - .github/workflows/maintenance.yml
       - .github/workflows/nddev-security-bundle.yml
       - .github/workflows/private-static.yml