diff --git a/.github/workflows/repository-control.yml b/.github/workflows/repository-control.yml
index b2499cc76b..2fa631d530 100644
--- a/.github/workflows/repository-control.yml
+++ b/.github/workflows/repository-control.yml
@@ -73,18 +73,27 @@ jobs:
             > "${RUNNER_TEMP}/repository-control-comments.json"
 
       - name: Require an exact owner transition record
+        id: transition-authorization
         env:
           KFM_AUTHORIZED_LOGIN: ${{ github.event.repository.owner.login }}
           KFM_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
         shell: bash
         run: |
           set -euo pipefail
+          set +e
           python3 tools/validators/repository_control/validate_transition_authorization.py \
             --event "${GITHUB_EVENT_PATH}" \
             --comments "${RUNNER_TEMP}/repository-control-comments.json" \
             --control-issue "${KFM_CONTROL_ISSUE}" \
             --authorized-login "${KFM_AUTHORIZED_LOGIN}" \
             --default-branch "${KFM_DEFAULT_BRANCH}"
+          status=$?
+          set -e
+          if [ "$status" -eq 3 ]; then
+            echo "Expected readiness hold; repository transition is not yet authorized."
+            exit 0
+          fi
+          exit "$status"
 
       - name: Record authority boundary
         if: always()
diff --git a/tests/validators/test_repository_transition_authorization.py b/tests/validators/test_repository_transition_authorization.py
index fb989fcaea..dc9e6f47d4 100644
--- a/tests/validators/test_repository_transition_authorization.py
+++ b/tests/validators/test_repository_transition_authorization.py
@@ -217,6 +217,16 @@ def test_workflow_keeps_event_metadata_out_of_shell_source() -> None:
     assert '--default-branch "${{ github.' not in workflow
 
 
+def test_workflow_treats_expected_readiness_hold_as_nonfailing() -> None:
+    workflow = WORKFLOW_PATH.read_text(encoding="utf-8")
+    assert 'id: transition-authorization' in workflow
+    assert 'status=$?' in workflow
+    assert 'if [ "$status" -eq 3 ]; then' in workflow
+    assert 'Expected readiness hold; repository transition is not yet authorized.' in workflow
+    assert 'exit 0' in workflow
+    assert 'exit "$status"' in workflow
+
+
 def test_non_default_target_is_not_applicable() -> None:
     event = load(EVENT_PATH)
     event["pull_request"]["base"]["ref"] = "maintenance"