diff --git a/plugins.lock.json b/plugins.lock.json
index ba8ce23..5e261db 100644
--- a/plugins.lock.json
+++ b/plugins.lock.json
@@ -13,7 +13,7 @@
   "gstack": {
     "source": "https://github.com/garrytan/gstack.git",
     "managed_by": "git submodule",
-    "note": "Version controlled by submodule pointer in .gitmodules. Update: git submodule update --remote"
+    "note": "Version controlled by submodule pointer in .gitmodules. Update: git submodule update --remote. Pinned at 11de390 (v1.58.5.0, job6): pulled deliberately for the #1911 fail-open security-guard fix (careful/guard/freeze/data-loss guards) after human review of #2047 (gbrowser stealth, accepted). Local playwright bump (BDR-029, BLK-008) is reset by every submodule update and re-applied by install-plugins.sh's gstack_bump_playwright_if_unsupported()."
   },
   "ctx7": {
     "source": "npm:ctx7",
diff --git a/skills-external/gstack b/skills-external/gstack
index 070722a..11de390 160000
--- a/skills-external/gstack
+++ b/skills-external/gstack
@@ -1 +1 @@
-Subproject commit 070722ace3989d5db9c66620c56504783ae64a07
+Subproject commit 11de390be1be6849eb9a15f91ff4922dd16c589a