diff --git a/actions/ql/lib/change-notes/2026-10-14-job-workflow-identity-source.md b/actions/ql/lib/change-notes/2026-10-14-job-workflow-identity-source.md
new file mode 100644
index 000000000000..9416de8a2013
--- /dev/null
+++ b/actions/ql/lib/change-notes/2026-10-14-job-workflow-identity-source.md
@@ -0,0 +1,4 @@
+---
+category: minorAnalysis
+---
+* The `job.workflow_ref`, `job.workflow_sha`, `job.workflow_repository` and `job.workflow_file_path` context properties are no longer treated as untrusted input in a reusable workflow with no known caller, which removes `actions/untrusted-checkout/medium` false positives on a reusable workflow that checks out its own source.
diff --git a/actions/ql/lib/codeql/actions/dataflow/FlowSources.qll b/actions/ql/lib/codeql/actions/dataflow/FlowSources.qll
index 8b0a2a33eb55..02899476afa1 100644
--- a/actions/ql/lib/codeql/actions/dataflow/FlowSources.qll
+++ b/actions/ql/lib/codeql/actions/dataflow/FlowSources.qll
@@ -225,7 +225,9 @@ class GitHubEventJsonSource extends RemoteFlowSource {
         or
         not exists(e.getATriggerEvent()) and
         event = "unknown" and
-        untrustedEventPropertiesDataModel(_, _)
+        untrustedEventPropertiesDataModel(_, _) and
+        not normalizeExpr(e.getExpression())
+            .regexpMatch("(?i)job\\.workflow_(ref|sha|repository|file_path)")
       ) and
       flag = "json"
     )
diff --git a/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/reusable_workflow_self_checkout.yml b/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/reusable_workflow_self_checkout.yml
new file mode 100644
index 000000000000..762c306123f1
--- /dev/null
+++ b/actions/ql/test/query-tests/Security/CWE-829/.github/workflows/reusable_workflow_self_checkout.yml
@@ -0,0 +1,11 @@
+on:
+  workflow_call:
+
+jobs:
+  checkout:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          repository: ${{ job.workflow_repository }}
+          ref: ${{ job.workflow_sha }}