@@ -1511,7 +1511,7 @@ jobs:
 // parser rejects is never skipped, in a workflow or a $/ composite, in
 // any mode or transport. Nothing is fetched or written.
 func TestFreshMalformedRemoteRefCannotOnboard(t *testing.T) {
-	for _, rejected := range []string{"actions/checkout@main:action.yml", "actions/checkout/.github/workflows/ci.yml@v4"} {
+	for _, rejected := range []string{"actions/checkout@main:action.yml", "actions/checkout/.github/workflows/ci.yml@v4", "actions/checkout@rel@1"} {
 		t.Run(rejected, func(t *testing.T) { testMalformedRemoteRefCannotOnboard(t, rejected) })
 	}
 }
@@ -1573,6 +1573,7 @@ func TestRemoteCompositeMalformedRefBlocks(t *testing.T) {
 	tests := map[string]string{
 		"actions/checkout@main:action.yml":             "uses: actions/checkout@main:action.yml is not an action reference the Actions backend accepts",
 		"actions/checkout/.github/workflows/ci.yml@v4": "reusable workflows should be referenced at the top-level `jobs.<job_id>.uses` key, not within steps",
+		"actions/checkout@rel@1":                       "uses: actions/checkout@rel@1 has more than one @",
 	}
 	for use, want := range tests {
 		t.Run(use, func(t *testing.T) { testRemoteCompositeMalformedRef(t, use, want) })
@@ -1601,3 +1602,85 @@ jobs:
 	assert.Contains(t, stderr, want)
 	assert.NoFileExists(t, filepath.Join(filepath.Dir(path), "actions.lock"))
 }
+
+// TestUppercaseSHAUseMatchesLowercaseKey: the lockfile spells full SHAs in
+// lowercase and a workflow may not; the workflow is left as written.
+func TestUppercaseSHAUseMatchesLowercaseKey(t *testing.T) {
+	lower := "94de994a9f6fffee200243214e17002e2920bb59"
+	upper := strings.ToUpper(lower)
+	path := writeTempWorkflow(t, `
+name: ci
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: octo/action@`+upper+`
+`, "octo/action@"+upper+"=sha1-"+upper+"=v1")
+	before, err := os.ReadFile(path)
+	require.NoError(t, err)
+
+	_, stderr, err := runCommandWithHTTP(t, &httpmock.Registry{}, "--verify-local", path)
+	require.NoError(t, err, stderr)
+
+	reg := &httpmock.Registry{}
+	reg.Register(httpmock.GraphQLForRepo("octo", "action"), httpmock.JSONResponse(map[string]any{
+		"data": map[string]any{"a0": testRepoResponse("octo/action", lower, nodeActionYAML)},
+	}))
+	_, stderr, err = runCommandWithHTTP(t, reg, "--no-narrow", "--no-interactive", path)
+	require.NoError(t, err, stderr)
+
+	after, err := os.ReadFile(path)
+	require.NoError(t, err)
+	assert.Equal(t, string(before), string(after))
+	lock := readTempLockfilePins(t)
+	assert.Contains(t, lock, "'octo/action@"+lower+"':")
+	assert.NotContains(t, lock, upper)
+
+	_, stderr, err = runCommandWithHTTP(t, &httpmock.Registry{}, "--verify-local", path)
+	require.NoError(t, err, stderr)
+}
+
+// TestRemoteCompositeUppercaseSHAChildLocksLowercase: a composite's child
+// pinned by an uppercase full SHA is locked under the lowercase key.
+func TestRemoteCompositeUppercaseSHAChildLocksLowercase(t *testing.T) {
+	const sha = "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee"
+	child := "94de994a9f6fffee200243214e17002e2920bb59"
+	composite := "name: c\nruns:\n  using: composite\n  steps:\n    - uses: actions/checkout@" + strings.ToUpper(child) + "\n"
+	reg := &httpmock.Registry{}
+	reg.Register(httpmock.GraphQLForRepo("octo", "composite"), httpmock.JSONResponse(map[string]any{
+		"data": map[string]any{"a0": testRepoResponse("octo/composite", sha, composite)},
+	}))
+	reg.Register(httpmock.GraphQLForRepo("actions", "checkout"), httpmock.JSONResponse(map[string]any{
+		"data": map[string]any{"a0": testRepoResponse("actions/checkout", child, nodeActionYAML)},
+	}))
+	reg.Register(httpmock.REST("GET", `repos/actions/checkout/tags`), httpmock.JSONResponse(httpmock.TagListResponse("v4.2.0", child)))
+	reg.Register(httpmock.REST("GET", `repos/actions/checkout/git/ref/heads/main`),
+		httpmock.JSONResponse(map[string]any{"ref": "refs/heads/main", "object": map[string]any{"sha": child, "type": "commit"}}))
+	reg.Register(httpmock.REST("GET", `repos/actions/checkout/branches`), httpmock.JSONResponse(httpmock.BranchListResponse("main", child)))
+	reg.Register(httpmock.REST("GET", `repos/actions/checkout$`),
+		httpmock.JSONResponse(map[string]any{"full_name": "actions/checkout", "default_branch": "main", "id": 1, "owner": map[string]any{"id": 1}}))
+	reg.Register(httpmock.REST("GET", `repos/octo/composite$`),
+		httpmock.JSONResponse(map[string]any{"full_name": "octo/composite", "default_branch": "main", "id": 2, "owner": map[string]any{"id": 2}}))
+	httpmock.NoTagsNamed(reg, "actions", "checkout")
+	isolateRunLogs(t)
+	path := writeTempWorkflow(t, `
+name: ci
+on: push
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: octo/composite@v1
+`)
+
+	_, stderr, err := runCommandWithHTTP(t, parityFallback{reg}, "--no-narrow", "--no-interactive", path)
+	require.NoError(t, err, stderr)
+	lock := readTempLockfilePins(t)
+	assert.Contains(t, lock, "- 'actions/checkout@"+child+"'")
+	assert.Contains(t, lock, "'actions/checkout@"+child+"':")
+	assert.NotContains(t, lock, strings.ToUpper(child))
+
+	_, stderr, err = runCommandWithHTTP(t, &httpmock.Registry{}, "--verify-local", path)
+	require.NoError(t, err, stderr)
+}
@@ -72,7 +72,8 @@ func fullSHAShaped(s string) bool {
 }
 
 // AcceptedRefName reports whether name is a ref name the Actions backend
-// accepts: a valid ref name that isn't shaped like `git describe` output.
+// accepts: a valid ref name that isn't shaped like `git describe` output and
+// has no @, which the backend's `uses:` grammar rejects.
 func AcceptedRefName(name string) bool {
-	return ValidRefName(name) && !describeSuffix.MatchString(name)
+	return ValidRefName(name) && !describeSuffix.MatchString(name) && !strings.Contains(name, "@")
 }
@@ -35,6 +35,7 @@ func TestAcceptedRefName(t *testing.T) {
 		{"v1-G1234", true}, // uppercase G
 		{"v1-g1234-rc", true},
 		{"main~1", false},
+		{"rel@1", false},
 	}
 	for _, tt := range tests {
 		assert.Equal(t, tt.want, AcceptedRefName(tt.name), tt.name)
 
@@ -11,9 +11,8 @@ import (
 	"github.com/github/gh-actions-lock/internal/ghapi"
 )
 
-// depToPin converts a dep.Dependency into a parserlock.Pin without any
-// case-normalization — callers should rely on Pin.String / Pin.Canonical for
-// the canonical form. Sub-action path is dropped: the lockfile pin grammar
+// depToPin converts a dep.Dependency into a parserlock.Pin with its full-SHA
+// ref spelled canonically; Pin.String folds owner/repo. Sub-action path is dropped: the lockfile pin grammar
 // identifies a downloaded tarball at repo+sha granularity, and distinct
 // subpaths in the same repo+ref collapse to one entry.
 func depToPin(d dep.Dependency) (parserlock.Pin, error) {
@@ -30,10 +29,20 @@ func depToPin(d dep.Dependency) (parserlock.Pin, error) {
 	return parserlock.Pin{
 		Owner: owner,
 		Repo:  repo,
-		Ref:   d.Ref,
+		Ref:   CanonicalRef(d.Ref),
 	}, nil
 }
 
+// CanonicalRef spells a full commit SHA in lowercase and returns any other
+// ref unchanged. The Actions backend matches a `uses:` ref to its lockfile
+// key exactly, so a full SHA has one spelling in both.
+func CanonicalRef(ref string) string {
+	if parserlock.IsFullSha(ref) {
+		return strings.ToLower(ref)
+	}
+	return ref
+}
+
 // ValidEntryRef reports whether ref is a lock entry ref the Actions backend
 // resolver accepts for pin: a short tag or branch name it accepts (never a
 // SHA, a refs/ name, revision syntax like main~1, or a `git describe` name),
 
@@ -73,7 +73,7 @@ func TestHostScopedMetadataAndPinCollisions(t *testing.T) {
 	require.NoError(t, store.SetHostname("tenant.ghe.com"))
 	sha := strings.Repeat("a", 40)
 	tenant := dep.Dependency{Hostname: "tenant.ghe.com", NWO: "o/r", Ref: "tenant", SHA: sha}
-	public := dep.Dependency{Hostname: "github.com", NWO: "o/r", Ref: "public", SHA: sha}
+	public := dep.Dependency{Hostname: "github.com", NWO: "o/q", Ref: "public", SHA: sha}
 	require.NoError(t, store.Set(context.Background(), ".github/workflows/ci.yml", []dep.Dependency{tenant, public}, nil, nil))
 	require.NoError(t, store.Save())
 	reloaded, err := LoadState(dir, nil)
@@ -82,20 +82,37 @@ func TestHostScopedMetadataAndPinCollisions(t *testing.T) {
 	file := reloaded.File()
 	assert.Empty(t, file.Dependencies["o/r@tenant"].Hostname)
 	assert.EqualValues(t, 20, file.Dependencies["o/r@tenant"].RepoID)
-	assert.Equal(t, "github.com", file.Dependencies["o/r@public"].Hostname)
-	assert.EqualValues(t, 2, file.Dependencies["o/r@public"].RepoID)
+	assert.Equal(t, "github.com", file.Dependencies["o/q@public"].Hostname)
+	assert.EqualValues(t, 2, file.Dependencies["o/q@public"].RepoID)
 	deps, err := reloaded.Get(".github/workflows/ci.yml")
 	require.NoError(t, err)
 	assert.ElementsMatch(t, []string{"github.com", "tenant.ghe.com"}, []string{deps[0].Hostname, deps[1].Hostname})
 	require.NoError(t, reloaded.Set(context.Background(), ".github/workflows/ci.yml", deps, nil, nil))
 	assert.EqualValues(t, 20, reloaded.File().Dependencies["o/r@tenant"].RepoID)
-	assert.EqualValues(t, 2, reloaded.File().Dependencies["o/r@public"].RepoID)
+	assert.EqualValues(t, 2, reloaded.File().Dependencies["o/q@public"].RepoID)
 
-	public.Ref = tenant.Ref
-	require.ErrorContains(t, store.Set(context.Background(), ".github/workflows/other.yml", []dep.Dependency{public}, nil, nil), "conflicting hosts")
-	fresh, err := LoadState(t.TempDir(), hostMetadata{})
-	require.NoError(t, err)
-	require.ErrorContains(t, fresh.Set(context.Background(), ".github/workflows/ci.yml", []dep.Dependency{tenant, public}, nil, nil), "conflicting hosts")
+	t.Run("rejects one pin on two hosts", func(t *testing.T) {
+		moved := public
+		moved.NWO, moved.Ref = tenant.NWO, tenant.Ref
+		require.ErrorContains(t, store.Set(context.Background(), ".github/workflows/other.yml", []dep.Dependency{moved}, nil, nil), "conflicting hosts")
+	})
+	t.Run("rejects one repository on two hosts in a write", func(t *testing.T) {
+		fresh, err := LoadState(t.TempDir(), hostMetadata{})
+		require.NoError(t, err)
+		other := public
+		other.NWO = tenant.NWO
+		require.ErrorContains(t, fresh.Set(context.Background(), ".github/workflows/ci.yml", []dep.Dependency{tenant, other}, nil, nil), "conflicting hosts")
+	})
+	t.Run("rejects a lockfile locking one repository on two hosts", func(t *testing.T) {
+		raw, err := os.ReadFile(filepath.Join(dir, parserlock.Path))
+		require.NoError(t, err)
+		require.NoError(t, os.WriteFile(filepath.Join(dir, parserlock.Path), []byte(strings.ReplaceAll(string(raw), "o/q@", "o/r@")), 0o600))
+		forged, err := LoadState(dir, nil)
+		require.NoError(t, err)
+		err = forged.SetHostname("tenant.ghe.com")
+		require.ErrorIs(t, err, ErrCorruptLockfile)
+		assert.ErrorContains(t, err, "o/r is locked on both github.com and tenant.ghe.com")
+	})
 }
 
 func TestLegacyAndOmittedHostnames(t *testing.T) {
 
@@ -9,6 +9,7 @@ import (
 	"maps"
 	"os"
 	"path/filepath"
+	"reflect"
 	"slices"
 	"sort"
 	"strings"
@@ -161,8 +162,8 @@ func LoadStateAt(lockfilePath string, meta MetadataResolver) (*State, error) {
 		idCache:         map[string][2]int64{},
 		hostname:        "github.com",
 	}
-	// Normalize on-disk entries to the canonical (lowercased) pin form so any
-	// legacy mixed-case keys are rewritten on the next Save.
+	// Normalize on-disk entries to the canonical pin form (owner/repo and full
+	// SHAs lowercased) so legacy mixed-case keys are rewritten on the next Save.
 	// Check entries in file order, so an invalid lockfile is always reported
 	// by its first bad entry.
 	lines, err := entryLines(contents)
@@ -182,22 +183,37 @@ func LoadStateAt(lockfilePath string, meta MetadataResolver) (*State, error) {
 		return cmp.Or(cmp.Compare(line(a), line(b)), strings.Compare(a, b))
 	})
 	normalizedDependencies := make(map[string]parserlock.Action, len(file.Dependencies))
+	spelledAs := make(map[string]string, len(file.Dependencies))
 	for _, pinKey := range keys {
 		action := file.Dependencies[pinKey]
 		pin, ok := parserlock.ParsePin(pinKey)
 		if !ok {
 			normalizedDependencies[pinKey] = action
 			continue
 		}
+		where := parserlock.Path
+		if n, ok := lines[pin.String()]; ok {
+			where = fmt.Sprintf("%s: line %d", where, n)
+		}
+		if strings.Contains(pin.Ref, "@") {
+			return nil, &contentError{fmt.Sprintf("%s: entry for %s has a ref containing @, which the Actions backend rejects", where, pinKey)}
+		}
 		if !ValidEntryRef(pin, action.Ref) && !RecordsOwnSHA(pin, action.Ref) {
-			where := parserlock.Path
-			if n, ok := lines[pin.String()]; ok {
-				where = fmt.Sprintf("%s: line %d", where, n)
-			}
 			return nil, &contentError{fmt.Sprintf("%s: entry for %s %s", where, pinKey, entryRefError(pin, action.Ref))}
 		}
+		pin.Ref = CanonicalRef(pin.Ref)
+		action.Ref = CanonicalRef(action.Ref)
+		action.Commit = strings.ToLower(action.Commit)
+		action.Uses = canonicalKeys(action.Uses)
 		canon := pin.String()
+		if prev, dup := normalizedDependencies[canon]; dup {
+			if !reflect.DeepEqual(prev, action) {
+				return nil, &contentError{fmt.Sprintf("%s: entries %s and %s spell one full SHA in different cases but record different dependencies", where, spelledAs[canon], pinKey)}
+			}
+			continue
+		}
 		normalizedDependencies[canon] = action
+		spelledAs[canon] = pinKey
 		if action.OwnerID != 0 && action.RepoID != 0 {
 			// idCache is keyed by lowercase owner/repo to match lookupIDs and the
 			// canonical pin reader; mixed-case keys here would silently miss.
@@ -206,22 +222,7 @@ func LoadStateAt(lockfilePath string, meta MetadataResolver) (*State, error) {
 	}
 	s.file.Dependencies = normalizedDependencies
 	for wfKey, deps := range s.file.Workflows {
-		changed := false
-		normalized := make([]string, len(deps))
-		for i, raw := range deps {
-			if pin, ok := parserlock.ParsePin(raw); ok {
-				canon := pin.String()
-				if canon != raw {
-					changed = true
-				}
-				normalized[i] = canon
-			} else {
-				normalized[i] = raw
-			}
-		}
-		if changed {
-			s.file.Workflows[wfKey] = normalized
-		}
+		s.file.Workflows[wfKey] = canonicalKeys(deps)
 	}
 	return s, nil
 }
@@ -233,6 +234,9 @@ func (s *State) SetHostname(hostname string) error {
 	defer s.mu.Unlock()
 	s.hostname = hostname
 	if hostname == "github.com" || ghapi.IsProxima(hostname) {
+		if err := s.checkOneHostPerRepo(); err != nil {
+			return err
+		}
 		s.idCache = map[string][2]int64{}
 		for key, action := range s.file.Dependencies {
 			if pin, ok := parserlock.ParsePin(key); ok && action.OwnerID != 0 && action.RepoID != 0 {
@@ -256,6 +260,24 @@ func (s *State) SetHostname(hostname string) error {
 	return nil
 }
 
+// checkOneHostPerRepo rejects a repository locked on two hosts: the Actions
+// backend binds each owner/repo to one host. Requires s.mu.
+func (s *State) checkOneHostPerRepo() error {
+	hosts := map[string]string{}
+	for _, key := range slices.Sorted(maps.Keys(s.file.Dependencies)) {
+		pin, ok := parserlock.ParsePin(key)
+		if !ok {
+			continue
+		}
+		host := s.hostOrHome(s.file.Dependencies[key].Hostname)
+		if prev, ok := hosts[pin.NWO]; ok && prev != host {
+			return &contentError{fmt.Sprintf("%s: %s is locked on both %s and %s; a repository can be locked on only one host", parserlock.Path, pin.NWO, prev, host)}
+		}
+		hosts[pin.NWO] = host
+	}
+	return nil
+}
+
 // File returns the in-memory parser-level lockfile snapshot. Intended for
 // consumers that drive the workflow-parser diagnostics engine directly and
 // need the whole file (workflow keys + actions metadata) in one shot.
@@ -610,11 +632,11 @@ func (s *State) Set(ctx context.Context, workflowKey string, deps []dep.Dependen
 		if hostname == "" {
 			hostname = s.hostname
 		}
-		pinKey := pin.Canonical().String()
-		if host, ok := pinHosts[pinKey]; ok && host != hostname {
-			return fmt.Errorf("dependency %s has conflicting hosts %s and %s", pinKey, host, hostname)
+		nwo := pin.Canonical().NWO
+		if host, ok := pinHosts[nwo]; ok && host != hostname {
+			return fmt.Errorf("dependency %s has conflicting hosts %s and %s", nwo, host, hostname)
 		}
-		pinHosts[pinKey] = hostname
+		pinHosts[nwo] = hostname
 		k := repoIDKey(hostname, pin.Owner, pin.Repo)
 		if _, ok := seenRepos[k]; ok {
 			continue
@@ -766,7 +788,7 @@ func (s *State) Set(ctx context.Context, workflowKey string, deps []dep.Dependen
 		s.file.Dependencies[pinKey] = parserlock.Action{
 			Hostname: hostname,
 			Ref:      ref,
-			Commit:   d.HashAlgoOrDetect() + "-" + d.SHA,
+			Commit:   d.HashAlgoOrDetect() + "-" + strings.ToLower(d.SHA),
 			OwnerID:  ids[0],
 			RepoID:   ids[1],
 			Uses:     uses,
@@ -787,6 +809,9 @@ func (s *State) Save() error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 	s.pruneOrphans()
+	if err := s.checkOneHostPerRepo(); err != nil {
+		return err
+	}
 
 	full := s.lockPath
 
@@ -927,6 +952,26 @@ func extractVersion(contents []byte) string {
 	return ""
 }
 
+// canonicalKeys spells each pin key canonically (see CanonicalRef) and
+// returns them sorted and deduplicated, as Save writes them, or nil.
+// Unparseable keys are kept.
+func canonicalKeys(keys []string) []string {
+	if len(keys) == 0 {
+		return nil
+	}
+	out := make([]string, 0, len(keys))
+	for _, raw := range keys {
+		key := raw
+		if pin, ok := parserlock.ParsePin(raw); ok {
+			pin.Ref = CanonicalRef(pin.Ref)
+			key = pin.String()
+		}
+		out = append(out, key)
+	}
+	slices.Sort(out)
+	return slices.Compact(out)
+}
+
 // isSHARef returns true when ref is a hex string of SHA-1 (40) or
 // SHA-256 (64) length.
 func isSHARef(ref string) bool {
Original file line number	Diff line number	Diff line change
`@@ -72,7 +72,8 @@ func fullSHAShaped(s string) bool {`
`72`	`72`	`}`
`73`	`73`
`74`	`74`	`// AcceptedRefName reports whether name is a ref name the Actions backend`
`75`		-// accepts: a valid ref name that isn't shaped like `git describe` output.
	`75`	+// accepts: a valid ref name that isn't shaped like `git describe` output and
	`76`	+// has no @, which the backend's `uses:` grammar rejects.
`76`	`77`	`func AcceptedRefName(name string) bool {`
`77`		`- return ValidRefName(name) && !describeSuffix.MatchString(name)`
	`78`	`+ return ValidRefName(name) && !describeSuffix.MatchString(name) && !strings.Contains(name, "@")`
`78`	`79`	`}`
Original file line number	Diff line number	Diff line change
`@@ -35,6 +35,7 @@ func TestAcceptedRefName(t *testing.T) {`
`35`	`35`	`{"v1-G1234", true}, // uppercase G`
`36`	`36`	`{"v1-g1234-rc", true},`
`37`	`37`	`{"main~1", false},`
	`38`	`+ {"rel@1", false},`
`38`	`39`	`}`
`39`	`40`	`for _, tt := range tests {`
`40`	`41`	`assert.Equal(t, tt.want, AcceptedRefName(tt.name), tt.name)`