diff --git a/README.md b/README.md
index 95f78fe8..fb7e4990 100644
--- a/README.md
+++ b/README.md
@@ -177,7 +177,7 @@ It is easier to use the web installer to flash GrapheneOS. However, it is recomm
 
 Root changes the device security model and can introduce compatibility breakage across ROM updates. Use it only when you understand the trade-offs for your device and selected ROM.
 
-PixeneOS defaults to the GrapheneOS-oriented `pixincreate/Magisk` fork. The repository is configurable through `MAGISK[REPOSITORY]` in `env.toml`; use another source only after confirming compatibility with the selected ROM. Magisk/Zygisk behavior can change across releases, so rooted builds should be revalidated after ROM or Magisk updates.
+ModOS defaults to the official `topjohnwu/Magisk` repository. The source remains configurable through `MAGISK[REPOSITORY]` in `env.toml`, but alternate Magisk forks are opt-in rather than part of the GrapheneOS build contract. If you use Zygisk Next for GrapheneOS compatibility, install and manage it separately from the OTA build. Magisk/Zygisk behavior can change across releases, so rooted builds should be revalidated after ROM, Magisk, or Zygisk changes.
 
 A Magisk-patched OTA is only the boot-image half of a working Magisk installation. On a clean install, after a data wipe, or whenever Magisk reports that additional setup is required, install/open the **matching Magisk manager APK**, accept **Additional setup / Environment fix**, and allow the device to reboot. That step provisions the runtime binaries (including `su`) under `/data/adb/magisk`; those files are device state and cannot be embedded in or verified from an OTA image.
 
diff --git a/env.toml b/env.toml
index 122838cc..7fc53059 100644
--- a/env.toml
+++ b/env.toml
@@ -7,9 +7,9 @@ ROM_FAMILY = "grapheneos"
 # For rooted builds, append the Magisk preinit device to every entry.
 # DEVICES = "bramble:sda10, shiba:sda10"
 
-# The maintained GrapheneOS-oriented default is pixincreate/Magisk.
-# Override this only when the selected ROM is compatible with another fork.
-# 'MAGISK[REPOSITORY]' = "pixincreate/Magisk"
+# The default is official Magisk from topjohnwu/Magisk.
+# Override this only when intentionally selecting another Magisk fork.
+# 'MAGISK[REPOSITORY]' = "topjohnwu/Magisk"
 
 [build]
 # Legacy single-output switch: false = rootless, true = Magisk.
diff --git a/src/ci/selection_variant.sh b/src/ci/selection_variant.sh
index 6f994cbf..df710817 100755
--- a/src/ci/selection_variant.sh
+++ b/src/ci/selection_variant.sh
@@ -16,6 +16,7 @@ function selection_variant_manifest() {
     SELECTION_OUTPUT_SCOPE
     SELECTION_ROOT
     SELECTION_MAGISK_PREINIT
+    SELECTION_MAGISK_REPOSITORY
     SELECTION_DEBUG
     SELECTION_COMPATIBLE_SEPOLICY
     SELECTION_CLEAR_VBMETA_FLAGS
@@ -97,6 +98,14 @@ function selection_variant_manifest() {
     "module.msd=${SELECTION_MODULE_MSD}" \
     "module.oemunlockonboot=${SELECTION_MODULE_OEMUNLOCKONBOOT}"
 
+  if [[ "${SELECTION_ROOT}" == 'true' ]]; then
+    if [[ ! "${SELECTION_MAGISK_REPOSITORY}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
+      echo "Error: rooted selection identity has an invalid Magisk repository." >&2
+      return 1
+    fi
+    printf '%s\n' "magisk_repository=${SELECTION_MAGISK_REPOSITORY}"
+  fi
+
   if [[ "${SELECTION_BOOT_ANIMATION}" == 'true' ]]; then
     printf '%s\n' \
       'boot_animation=true' \
diff --git a/src/config_schema.sh b/src/config_schema.sh
index f1bcebcf..10584759 100644
--- a/src/config_schema.sh
+++ b/src/config_schema.sh
@@ -77,7 +77,7 @@ _config_schema_define magisk_preinit MAGISK_PREINIT build string \
 _config_schema_define update_channel 'GRAPHENEOS[UPDATE_CHANNEL]' device string \
   GRAPHENEOS array UPDATE_CHANNEL GRAPHENEOS_UPDATE_CHANNEL '' true existing-or-default
 _config_schema_define magisk_repository 'MAGISK[REPOSITORY]' device string \
-  MAGISK array REPOSITORY '' pixincreate/Magisk false caller-or-default
+  MAGISK array REPOSITORY '' topjohnwu/Magisk false caller-or-default
 _config_schema_define afsr 'ADDITIONALS[AFSR]' build boolean \
   ADDITIONALS array AFSR ADDITIONALS_AFSR true true caller-or-existing-or-default
 _config_schema_define alterinstaller 'ADDITIONALS[ALTERINSTALLER]' build boolean \
diff --git a/src/rom_profiles.sh b/src/rom_profiles.sh
index 44c1cc7e..3ed3d523 100644
--- a/src/rom_profiles.sh
+++ b/src/rom_profiles.sh
@@ -150,6 +150,7 @@ function module_selection_fingerprint() {
   local lock_digest="disabled"
   local profile_digest="disabled"
   local magisk_preinit="disabled"
+  local magisk_repository="disabled"
   local boot_animation_digest="disabled"
   local entry
   local -a module_entries=(
@@ -184,10 +185,15 @@ function module_selection_fingerprint() {
 
   if [[ "${ADDITIONALS[ROOT]}" == 'true' ]]; then
     magisk_preinit="${MAGISK[PREINIT]}"
+    magisk_repository="${MAGISK[REPOSITORY]}"
     if [[ ! "${magisk_preinit}" =~ ^[A-Za-z0-9._-]+$ ]]; then
       echo "Error: rooted profiles require a canonical Magisk preinit device." >&2
       return 1
     fi
+    if [[ ! "${magisk_repository}" =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]]; then
+      echo "Error: rooted profiles require a canonical Magisk repository." >&2
+      return 1
+    fi
   fi
 
   if [[ "${ADDITIONALS[FDROID_PRIVILEGED_EXTENSION]}" == 'true' ]]; then
@@ -207,6 +213,7 @@ function module_selection_fingerprint() {
   SELECTION_OUTPUT_SCOPE="${OUTPUT_SCOPE}"
   SELECTION_ROOT="${ADDITIONALS[ROOT]}"
   SELECTION_MAGISK_PREINIT="${magisk_preinit}"
+  SELECTION_MAGISK_REPOSITORY="${magisk_repository}"
   SELECTION_DEBUG="${ADDITIONALS[DEBUG]}"
   SELECTION_COMPATIBLE_SEPOLICY="${ADDITIONALS[MAS_COMPATIBLE_SEPOLICY]}"
   SELECTION_CLEAR_VBMETA_FLAGS="${ROM_PROFILE[CLEAR_VBMETA_FLAGS]}"
diff --git a/tests/rom_contract_test.sh b/tests/rom_contract_test.sh
index fc5b3284..dd97d3e4 100644
--- a/tests/rom_contract_test.sh
+++ b/tests/rom_contract_test.sh
@@ -77,6 +77,12 @@ test_profiles_are_stable() {
     https://download.lineageos.org/api/v2
 }
 
+test_magisk_repository_default() (
+  load_contract
+  assert_equals "topjohnwu/Magisk" "${MAGISK[REPOSITORY]}" \
+    "default Magisk repository"
+)
+
 test_unknown_rom_fails_closed() (
   load_contract
   ROM_FAMILY="unknown-rom"
@@ -126,6 +132,7 @@ fingerprint() {
 test_selection_fingerprint() (
   local baseline repeated afsr_on afsr_off root_changed rom_changed module_changed
   local boot_changed second_boot_changed fingerprint_input
+  local rootless_repo_changed rooted_repo_changed
 
   load_contract
   set_selection_fixture
@@ -145,6 +152,12 @@ test_selection_fingerprint() (
   assert_equals "${afsr_on}" "$(fingerprint)" \
     "AFSR-on selection did not preserve the exact identity"
 
+  MAGISK[REPOSITORY]="pixincreate/Magisk"
+  rootless_repo_changed="$(fingerprint)"
+  assert_equals "${baseline}" "${rootless_repo_changed}" \
+    "rootless selection must not depend on the Magisk repository"
+  MAGISK[REPOSITORY]="topjohnwu/Magisk"
+
   fingerprint_input="${TEST_ROOT}/fingerprint-input-${BASHPID}"
   sha256sum() {
     tee "${fingerprint_input}" | command sha256sum
@@ -161,6 +174,12 @@ test_selection_fingerprint() (
   [[ "${root_changed}" != "${baseline}" ]] ||
     fail "root selection did not change the fingerprint"
 
+  MAGISK[REPOSITORY]="pixincreate/Magisk"
+  rooted_repo_changed="$(fingerprint)"
+  [[ "${rooted_repo_changed}" != "${root_changed}" ]] ||
+    fail "Magisk repository selection did not change the rooted fingerprint"
+  MAGISK[REPOSITORY]="topjohnwu/Magisk"
+
   MAGISK[PREINIT]="sda47"
   local preinit_changed
   preinit_changed="$(fingerprint)"
@@ -263,6 +282,7 @@ test_output_policy() (
 )
 
 test_profiles_are_stable
+test_magisk_repository_default
 test_unknown_rom_fails_closed
 test_invalid_compatible_sepolicy_fails_closed
 test_selection_fingerprint
diff --git a/tests/upstream_integration_test.sh b/tests/upstream_integration_test.sh
index 65fb5601..68250339 100644
--- a/tests/upstream_integration_test.sh
+++ b/tests/upstream_integration_test.sh
@@ -12,7 +12,10 @@ grep -Fq 'VERSION[BCR]="${VERSION[BCR]:-3.9}"' src/declarations.sh || fail "BCR
 grep -Fq 'VERSION[CUSTOTA]="${VERSION[CUSTOTA]:-6.5}"' src/declarations.sh || fail "Custota pin is not 6.5"
 grep -Fq 'VERSION[AVBROOT_SETUP]="634e6185cf70ea3ec9229ae957ddf2304f52e9e8"' src/declarations.sh || fail "maintained helper pin is unexpected"
 grep -Fq '"version": "2.0.0"' locks/executable-tools-v1.json || fail "AFSR 2.0 lock entry is missing"
-grep -Fq "pixincreate/Magisk" src/config_schema.sh || fail "GrapheneOS-oriented Magisk default is missing"
+grep -Fq "topjohnwu/Magisk" src/config_schema.sh || fail "official Magisk default is missing"
+if grep -Fq "pixincreate/Magisk" src/config_schema.sh; then
+  fail "pixincreate Magisk must remain opt-in rather than the default"
+fi
 
 if grep -Fq "Charge Limit" README.md; then
   fail "README still advertises unsupported Charge Limit integration"