diff --git a/.github/scripts/tests/test_notify_workflow.py b/.github/scripts/tests/test_notify_workflow.py
new file mode 100644
index 00000000..e4a7e92b
--- /dev/null
+++ b/.github/scripts/tests/test_notify_workflow.py
@@ -0,0 +1,25 @@
+import re
+from pathlib import Path
+
+
+WORKFLOW_PATH = Path(__file__).parents[2] / "workflows" / "notify.yml"
+SHARED_WORKFLOW_SHA = "6cade565b59817027aa0fe4949d5923286b6675c"
+
+
+def test_notify_workflow_reuses_pinned_shared_implementation() -> None:
+    workflow = WORKFLOW_PATH.read_text()
+    match = re.search(r"(?ms)^  notify:\n(.*)\Z", workflow)
+
+    assert match is not None
+    notify_job = match.group(1)
+    assert (
+        "uses: aws/aws-durable-execution-ci/.github/workflows/notify.yml@"
+        f"{SHARED_WORKFLOW_SHA}"
+    ) in notify_job
+    assert "contents: read" in notify_job
+    assert "models: read" in notify_job
+    assert "runs-on:" not in notify_job
+    assert "summarize_notification.py" not in notify_job
+    assert "SLACK_WEBHOOK_URL_PR" in notify_job
+    assert "SLACK_WEBHOOK_URL_ISSUE" in notify_job
+    assert "SLACK_WEBHOOK_URL_RELEASE" in notify_job
diff --git a/.github/workflows/notify.yml b/.github/workflows/notify.yml
index ec9dbc8e..91dac356 100644
--- a/.github/workflows/notify.yml
+++ b/.github/workflows/notify.yml
@@ -12,7 +12,10 @@ permissions: {}
 
 jobs:
   notify:
-    uses: aws/aws-durable-execution-ci/.github/workflows/notify.yml@71259cf476e37255752d8f9445a1a48ec92be1df
+    permissions:
+      contents: read
+      models: read
+    uses: aws/aws-durable-execution-ci/.github/workflows/notify.yml@6cade565b59817027aa0fe4949d5923286b6675c
     secrets:
       SLACK_WEBHOOK_URL_PR: ${{ secrets.SLACK_WEBHOOK_URL_PR }}
       SLACK_WEBHOOK_URL_ISSUE: ${{ secrets.SLACK_WEBHOOK_URL_ISSUE }}
diff --git a/.github/workflows/test-parser.yml b/.github/workflows/test-parser.yml
index fde37133..7fda19e1 100644
--- a/.github/workflows/test-parser.yml
+++ b/.github/workflows/test-parser.yml
@@ -6,12 +6,14 @@ on:
       - '.github/scripts/build_lambda_layer.py'
       - '.github/scripts/parse_sdk_branch.py'
       - '.github/scripts/tests/**'
+      - '.github/workflows/notify.yml'
   push:
     branches: [ main ]
     paths:
       - '.github/scripts/build_lambda_layer.py'
       - '.github/scripts/parse_sdk_branch.py'
       - '.github/scripts/tests/**'
+      - '.github/workflows/notify.yml'
 
 permissions:
   contents: read
@@ -29,4 +31,5 @@ jobs:
       run: |
         python -m pytest \
           .github/scripts/tests/test_build_lambda_layer.py \
+          .github/scripts/tests/test_notify_workflow.py \
           .github/scripts/tests/test_parse_sdk_branch.py