diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml
index 749f5bb6786..8b2afc83dca 100644
--- a/.github/workflows/ingest.yml
+++ b/.github/workflows/ingest.yml
@@ -29,7 +29,7 @@ jobs:
     permissions:
       contents: write # Push the bot-owned candidate branch.
       pull-requests: write # Open a pull request for that branch.
-    # Local Aug 2026 measurement with --no-history and the trimmed
+    # Baseline local Aug 2026 measurement with --no-history and the trimmed
     # data/repology.json (select_ecosystems + overrides.yml skip applied):
     # 90820 records in 126.4 min, peak RSS 1.68 GB.
     timeout-minutes: 180
@@ -42,6 +42,10 @@ jobs:
         uses: Homebrew/actions/setup-homebrew@8f3d1ec8a696b3b9d9a6c3696b6c73033cab69e4 # 2026.08.14.1
         with:
           core: true
+          # --new-history is an authoring capability from brew main. Keeping
+          # the explicit flag makes older clients fail fast instead of walking
+          # history for every existing record.
+          stable: false
 
       - name: Set up Ruby
         uses: Homebrew/actions/setup-ruby@8f3d1ec8a696b3b9d9a6c3696b6c73033cab69e4 # 2026.08.14.1
@@ -65,15 +69,11 @@ jobs:
           HOMEBREW_NO_INSTALL_FROM_API: 1
         # Run one bulk sweep to avoid extra OSV traffic and live Repology fallbacks.
         # Split its output into formula-stable branches below.
-        # --no-history: the FormulaVersions walk for every :fixed hit across
-        # ~8500 formulae would exceed the job limit. New records get
-        # `fixed: <current pkg_version>` which reviewers tighten per
-        # CONTRIBUTING; existing records keep their on-disk ranges via
-        # OsvExport.merge_existing regardless. Drop this flag once
-        # `brew advisory-match` gains a "walk history only for records not
-        # already on disk" mode.
+        # Existing records keep their reviewed ranges; new fixed candidates get
+        # the first Homebrew version that shipped the fix. The matcher reports
+        # the residual history-walk count so full-sweep cost remains visible.
         run: >
-          brew advisory-match --all --verbose --output advisories --no-history
+          brew advisory-match --all --verbose --output advisories --new-history
           --repology data/repology.json
 
       - name: Drop uncomparable and rejected candidates
diff --git a/spec/workflows_spec.rb b/spec/workflows_spec.rb
index 2d6f8a84a24..584798482d2 100644
--- a/spec/workflows_spec.rb
+++ b/spec/workflows_spec.rb
@@ -59,6 +59,7 @@
                                      aliases: true)
     ingest = YAML.safe_load_file(File.expand_path("../.github/workflows/ingest.yml", __dir__), aliases: true)
     steps = ingest.dig("jobs", "match", "steps")
+    setup_homebrew = steps.find { |step| step["name"] == "Set up Homebrew" }
     build_index = steps.index { |step| step["name"] == "Build Repology index" }
     match_index = steps.index { |step| step["name"] == "Match advisories" }
     build = steps.fetch(build_index).fetch("run")
@@ -69,6 +70,10 @@
     expect(build_index).to be < match_index
     expect(build).to include("bundle exec rake repology:build")
     expect(build).to include("::warning::")
+    expect(setup_homebrew.dig("with", "stable")).to be false
+    expect(match).to include("--output advisories")
+    expect(match).to include("--new-history")
+    expect(match).not_to include("--no-history")
     expect(match).to include("--repology data/repology.json")
   end