diff --git a/AGENTS.md b/AGENTS.md
index 7f7cc345eaa..fa5f149f078 100755
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -187,4 +187,5 @@ Then follow post-install instructions (permissions / accessibility as prompted).
 - Before opening a Winget PR, verify the release installer URL resolves and recompute the SHA-256 from the downloaded asset. On Windows, run `winget validate` when available.
 - The first Winget package submission was approved in `microsoft/winget-pkgs#366653`; the v0.23.5 update was approved in `microsoft/winget-pkgs#366794`. Future updates should be faster, but still expect Microsoft validation/review.
 - Agents must route GitHub mutations through `scripts/gh-safe.sh` instead of calling mutating `gh` subcommands directly. This is the sole supported mutation wrapper. It owns repo binding, performs read-back verification, blocks repo overrides, and fails closed on target mismatch.
+- `gh-safe.sh` allowlists three repos: `nesszer/Win-CodexBar`, plus `Finesssee/winget-pkgs` (the fork that receives the manifest branch) and `microsoft/winget-pkgs` (where the winget PR opens).
 - For object mutations (PR/issue/release), bind both the exact `owner/repo` and exact object number/tag. Use repo-only verification only for creates where the target object does not exist yet.
diff --git a/scripts/gh-safe.sh b/scripts/gh-safe.sh
index d64cc1f0555..a0ae12e4b68 100644
--- a/scripts/gh-safe.sh
+++ b/scripts/gh-safe.sh
@@ -15,6 +15,7 @@ Usage:
 Examples:
   bash scripts/gh-safe.sh --repo nesszer/Win-CodexBar --verify-kind pr --target 361 --what-if -- pr comment 361 --body-file .review/comment.md
   bash scripts/gh-safe.sh --repo nesszer/Win-CodexBar --verify-kind repo --what-if -- pr create --title "..." --body-file body.md
+  bash scripts/gh-safe.sh --repo microsoft/winget-pkgs --verify-kind repo --what-if -- pr create --head Finesssee:branch --title "..." --body-file body.md
 EOF
 }
 
@@ -39,9 +40,12 @@ case "$verify_kind" in repo|pr|issue|release) ;; *) echo "Invalid --verify-kind
 
 if [[ "${repo,,}" == "steipete/codexbar" ]]; then
   ((allow_upstream_write == 1)) || { echo 'Writes to steipete/CodexBar are blocked by default. Explicit current-turn authorization is required.' >&2; exit 3; }
-elif [[ "${repo,,}" != "nesszer/win-codexbar" ]]; then
-  echo "GitHub writes are not allowlisted for '$repo'. Expected nesszer/Win-CodexBar." >&2
-  exit 3
+else
+  # Winget release step: the fork receives the manifest branch, and the PR opens on microsoft/winget-pkgs.
+  case "${repo,,}" in
+    nesszer/win-codexbar|finesssee/winget-pkgs|microsoft/winget-pkgs) ;;
+    *) echo "GitHub writes are not allowlisted for '$repo'. Expected nesszer/Win-CodexBar, Finesssee/winget-pkgs or microsoft/winget-pkgs." >&2; exit 3 ;;
+  esac
 fi
 
 for arg in "${gh_args[@]}"; do
diff --git a/scripts/gh-safe.tests.sh b/scripts/gh-safe.tests.sh
index 6fac0c422d3..25f58ec9c90 100644
--- a/scripts/gh-safe.tests.sh
+++ b/scripts/gh-safe.tests.sh
@@ -17,7 +17,7 @@ if [[ "${FAKE_GH_MODE:-ok}" == cross ]]; then
   exit 0
 fi
 if [[ "${1:-}" == repo && "${2:-}" == view ]]; then
-  printf '%s\n' 'nesszer/Win-CodexBar|https://github.com/nesszer/Win-CodexBar'
+  printf '%s\n' "${3:?}|https://github.com/${3:?}"
 elif [[ "${1:-}" == pr && "${2:-}" == view ]]; then
   printf '%s\n' 'https://github.com/nesszer/Win-CodexBar/pull/361'
 elif [[ "${1:-}" == issue && "${2:-}" == view ]]; then
@@ -53,6 +53,22 @@ expect_fail bash "$repo_root/scripts/gh-safe.sh" \
   --repo other/repo --verify-kind repo --what-if -- \
   pr create --title test --body test
 
+bash "$repo_root/scripts/gh-safe.sh" \
+  --repo microsoft/winget-pkgs --verify-kind repo --what-if -- \
+  pr create --head Finesssee:test --title test --body test >/dev/null
+
+bash "$repo_root/scripts/gh-safe.sh" \
+  --repo Finesssee/winget-pkgs --verify-kind repo --what-if -- \
+  api repos/Finesssee/winget-pkgs/merge-upstream -X POST -f branch=master >/dev/null
+
+expect_fail bash "$repo_root/scripts/gh-safe.sh" \
+  --repo Finesssee/winget-pkgs --verify-kind repo --what-if -- \
+  api repos/microsoft/winget-pkgs/git/refs -X POST -f ref=refs/heads/test
+
+expect_fail bash "$repo_root/scripts/gh-safe.sh" \
+  --repo other/winget-pkgs --verify-kind repo --what-if -- \
+  pr create --title test --body test
+
 expect_fail bash "$repo_root/scripts/gh-safe.sh" \
   --repo nesszer/Win-CodexBar --verify-kind pr --target 361 --what-if -- \
   pr comment 362 --body test