diff --git a/pyproject.toml b/pyproject.toml
index 98f404a..73638a4 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -23,7 +23,7 @@ dependencies = [
     # action-mirror and provenance-mirror pins were labelled "v0.2.0" while
     # sitting TWO commits before that tag, so an install got the pre-org-migration
     # docs (stale `bhyi4/` self-references, SPEC v1.0) under a v0.2.0 label.
-    "measure-mirror @ git+https://github.com/mirror-stack/measure-mirror@21ca28937306a6e094c6505f79810c204eee5173",      # v0.32.0 — ㉘ vacuous both-directions on real runs (computed matched-null certificate); catalog count sync 72 + KO count guards
+    "measure-mirror @ git+https://github.com/mirror-stack/measure-mirror@895ad803a42ef8ebf9e05b90326973fbc2d93f21",      # v0.33.0 — (auto-pin: was v0.32.0 21ca2893; verify via CI test_pins_are_releases + fixtures) — ㉘ vacuous both-directions on real runs (computed matched-null certificate); catalog count sync 72 + KO count guards
     "action-mirror @ git+https://github.com/mirror-stack/action-mirror@15b0c5b775e916a22d837ddc0714e85aef7ec74e",        # v0.2.0 — full 64-hex SHA-256 seals (security; legacy 16-hex verify via prefix match); org migration + SPEC v1.1 references
     "provenance-mirror @ git+https://github.com/mirror-stack/provenance-mirror@2d1d52d280352567410d140270f7714571bf784f",  # v0.2.0 — full 64-hex SHA-256 seals (security; legacy 16-hex verify via prefix match); org migration + SPEC v1.1 references
 ]