diff --git a/CHANGELOG.md b/CHANGELOG.md
index 450969f..a2a9a95 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,7 +15,7 @@ Everything below is new; there is no earlier release to change or fix against. T
 - Add `tests/smoke.sh` — end-to-end installer test against a throwaway consumer repo: idempotency, the ownership guarantee, relative links, DENY skills never linked, pruning, verify, dry-run, a non-damascus path in the way fails the run, clean uninstall
 - Add CI: shellcheck + syntax checks; repo integrity sourced from `install.sh`'s own name arrays (stage skills, aliases, agents, KEEP skills all exist; every upstream superpowers skill is classified KEEP or DENY); frontmatter lint; vendor submodules must sit on an upstream tag named in the README; the example artifact trail must be complete; the smoke test on Ubuntu and macOS (including stock bash 3.2); a changelog-updated gate on PRs
 - Add a tag-triggered `Release` workflow that publishes the GitHub Release from the matching `CHANGELOG.md` section
-- Vendor [obra/superpowers](https://github.com/obra/superpowers) v6.3.0 and [github/spec-kit](https://github.com/github/spec-kit) v1.0.5 as pinned submodules, with the DENY / KEEP / CONDITIONAL policy: `brainstorming`, `writing-plans`, `executing-plans`, `requesting-code-review`, `using-superpowers`, `subagent-driven-development` are DENY (a stage replaces them, or they route into one that does); `test-driven-development` is linked but overridden by red-amber-green; the remaining seven are linked as-is
+- Vendor [obra/superpowers](https://github.com/obra/superpowers) v6.3.0 and [github/spec-kit](https://github.com/github/spec-kit) v1.0.6 as pinned submodules, with the DENY / KEEP / CONDITIONAL policy: `brainstorming`, `writing-plans`, `executing-plans`, `requesting-code-review`, `using-superpowers`, `subagent-driven-development` are DENY (a stage replaces them, or they route into one that does); `test-driven-development` is linked but overridden by red-amber-green; the remaining seven are linked as-is
 - Add `examples/cart-discounts/` — one feature's complete artifact trail through all five gates (`.prd/`, spec triplet, `review.md`, `quench-log.md`, `code-review.md`, `smithy-log.md`) with a gate-by-gate reading guide and a "which stage do I start at?" note, also surfaced in the README
 - Add Dependabot config for monthly vendor-submodule and GitHub Actions bumps, and a bug-report issue template
 - Add README (pipeline table, review-loop and finish-step descriptions, requirements incl. the shipped agents' Python/FastAPI shape, pinned-tag install, upgrading, vendored-submodule pins, policy table, support posture, credits), `docs/production-readiness.md` (the phased single-founder plan), MIT `LICENSE` (vendored submodules retain their upstream licenses), and the release ritual and bump policy in CLAUDE.md
diff --git a/README.md b/README.md
index c471b1c..2035ada 100644
--- a/README.md
+++ b/README.md
@@ -110,7 +110,7 @@ Breaking changes to skill contracts or `install.sh` behavior are called out in [
 | Submodule | Pin | Role |
 |-----------|-----|------|
 | [obra/superpowers](https://github.com/obra/superpowers) | v6.3.0 | process-discipline skills; KEEP-class linked at install |
-| [github/spec-kit](https://github.com/github/spec-kit) | v1.0.5 | `anvil`'s fallback templates (`templates/{spec,plan,tasks}-template.md`) when `/speckit.*` slash commands aren't registered |
+| [github/spec-kit](https://github.com/github/spec-kit) | v1.0.6 | `anvil`'s fallback templates (`templates/{spec,plan,tasks}-template.md`) when `/speckit.*` slash commands aren't registered |
 
 CI checks that each pointer sits exactly on an upstream tag and that this table names it, so a bump is always deliberate: check out the tag, update the row, note it in the changelog.
 
diff --git a/vendor/spec-kit b/vendor/spec-kit
index a4e25ce..96c9bd6 160000
--- a/vendor/spec-kit
+++ b/vendor/spec-kit
@@ -1 +1 @@
-Subproject commit a4e25ce6b96dc8e85f84206c6a54353fa9c5260b
+Subproject commit 96c9bd657bfd5de0d651a6165084932b7304ac99