diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml
index 2c4ee46..4e3dd22 100644
--- a/.github/workflows/security-analysis.yml
+++ b/.github/workflows/security-analysis.yml
@@ -46,3 +46,32 @@ jobs:
       run-safety: false  # safety removed from deps; pip-audit covers vulnerability scanning
       run-osv: true
       no-build: false  # project uses hatchling build backend; uv must build the editable install
+
+  # Bare "Security Gate Validation" context required by the org ruleset.
+  # The reusable security workflow surfaces as
+  # "Security Analysis / Security Gate Validation" (caller / reusable job),
+  # which cannot match the bare ruleset context. This in-line aggregator
+  # re-emits the bare context on pull_request and inside the merge queue.
+  security-gate:
+    name: Security Gate Validation
+    runs-on: ubuntu-latest
+    needs: [security]
+    if: always()
+    timeout-minutes: 5
+    permissions:
+      contents: read
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5  # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: ''
+      - name: Aggregate security result
+        run: |
+          result="${{ needs.security.result }}"
+          if [ "$result" = "success" ] || [ "$result" = "skipped" ]; then
+            echo "Security Gate Validation: passed (result: $result)"
+          else
+            echo "::error::Security Gate Validation failed: $result"
+            exit 1
+          fi