diff --git a/.github/workflows/maintenance-consumer.yml b/.github/workflows/maintenance-consumer.yml
index 88a09ff..c8facd2 100644
--- a/.github/workflows/maintenance-consumer.yml
+++ b/.github/workflows/maintenance-consumer.yml
@@ -436,6 +436,7 @@ jobs:
       pull-requests: write
       checks: write
       actions: write
+      statuses: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
diff --git a/docs/repository-settings.md b/docs/repository-settings.md
index 5d1d97f..6c458f8 100644
--- a/docs/repository-settings.md
+++ b/docs/repository-settings.md
@@ -28,7 +28,8 @@ Required repository state:
   deterministic PR coordinator explicitly dispatches `ci.yml` and
   `protected-controls.yml` at the exact PR branch, accepts only newly created
   successful validator runs for that head SHA, and only then publishes the
-  Actions-owned required checks onto the PR rollup with the validator URLs.
+  Actions-owned check evidence plus PR-visible commit statuses with the exact
+  validator URLs.
 - Allow GitHub-owned Actions plus only `openai/codex-action` and
   `jdx/mise-action`, and require every Action reference to use a full commit
   SHA.
diff --git a/scripts/dispatch-pr-checks b/scripts/dispatch-pr-checks
index 3c1b182..c19cc15 100755
--- a/scripts/dispatch-pr-checks
+++ b/scripts/dispatch-pr-checks
@@ -102,6 +102,16 @@ while ((SECONDS < deadline)); do
       # after both new validator runs pass, retaining their URLs as evidence.
       primary_gate="$(publish_gate "$primary")"
       protected_gate="$(publish_gate "$protected")"
+      for validator in "$primary" "$protected"; do
+        name="$(jq -r .name <<<"$validator")"
+        details="$(jq -r .details_url <<<"$validator")"
+        gh api --method POST -H "Accept: application/vnd.github+json" \
+          "repos/$repository/statuses/$head_sha" \
+          -f state=success \
+          -f "context=$name" \
+          -f "target_url=$details" \
+          -f description="Exact-head dispatched validator passed" >/dev/null
+      done
       for _ in {1..24}; do
         rollup="$(gh pr checks "$pr_number" --repo "$repository" --required \
           --json name,bucket,link 2>/dev/null || true)"
diff --git a/test/test_maintenance.py b/test/test_maintenance.py
index 157fb62..4add3d5 100644
--- a/test/test_maintenance.py
+++ b/test/test_maintenance.py
@@ -214,10 +214,12 @@ def test_token_created_prs_explicitly_dispatch_required_checks(self):
         self.assertIn("gh workflow run ci.yml", dispatcher)
         self.assertIn("gh workflow run protected-controls.yml", dispatcher)
         self.assertIn('"repos/$repository/check-runs"', dispatcher)
+        self.assertIn('"repos/$repository/statuses/$head_sha"', dispatcher)
         self.assertIn("Exact-head validator passed", dispatcher)
         self.assertIn("./scripts/dispatch-pr-checks", consumer)
         self.assertNotIn("gh pr checks", consumer)
         self.assertIn("checks: write", consumer)
+        self.assertIn("statuses: write", consumer)
 
 
 if __name__ == "__main__":