diff --git a/Cargo.lock b/Cargo.lock
index b412fe8..98a9860 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -890,7 +890,7 @@ dependencies = [
  "domain",
  "futures",
  "insta",
- "itertools 0.14.0",
+ "itertools",
  "open",
  "proptest",
  "pulldown-cmark",
@@ -1217,15 +1217,6 @@ dependencies = [
  "either",
 ]
 
-[[package]]
-name = "itertools"
-version = "0.14.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2b192c782037fadd9cfa75548310488aabdbf3d2da73885b31bd0abd03351285"
-dependencies = [
- "either",
-]
-
 [[package]]
 name = "itoa"
 version = "1.0.18"
@@ -1728,7 +1719,7 @@ dependencies = [
  "crossterm",
  "indoc",
  "instability",
- "itertools 0.13.0",
+ "itertools",
  "lru",
  "paste",
  "strum",
@@ -2701,7 +2692,7 @@ version = "1.1.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b3644627a5af5fa321c95b9b235a72fd24cd29c648c2c379431e6628655627bf"
 dependencies = [
- "itertools 0.13.0",
+ "itertools",
  "unicode-segmentation",
  "unicode-width 0.1.14",
 ]
diff --git a/deny.toml b/deny.toml
index 3a9c963..38c2c2e 100644
--- a/deny.toml
+++ b/deny.toml
@@ -4,13 +4,13 @@
   # These are cross-major-version splits not controllable without upstream changes.
   skip = [
     { name = "core-foundation" },
-    { name = "crossterm" },
     { name = "getrandom" },
     { name = "hashbrown" },
     { name = "linux-raw-sys" },
     { name = "rustix" },
     { name = "thiserror" },
     { name = "thiserror-impl" },
+    { name = "unicode-width" },
     { name = "windows-sys" },
     { name = "windows-targets" },
     { name = "windows_aarch64_gnullvm" },
diff --git a/ui/tui/Cargo.toml b/ui/tui/Cargo.toml
index 4461e5e..0c4b160 100644
--- a/ui/tui/Cargo.toml
+++ b/ui/tui/Cargo.toml
@@ -20,7 +20,10 @@
   crossterm = { version = "0.28", features = ["event-stream"] }
   domain = { path = "../../domain" }
   futures = "0.3"
-  itertools = "0.14"
+  # Pinned to 0.13 to unify with ratatui 0.29, which also depends on itertools 0.13.
+  # cargo-deny's bans check rejects duplicate versions; only with_position()/Position
+  # are used here, an API present in both 0.13 and 0.14. Bump in lockstep with ratatui.
+  itertools = "0.13"
   open = "5"
   pulldown-cmark = { version = "0.13", default-features = false }
   # Pinned to 0.29 to unify with tui-textarea 0.7, which also depends on 0.29.
diff --git a/workflows/src/dispatch.rs b/workflows/src/dispatch.rs
index 7adeb91..37d5b9d 100644
--- a/workflows/src/dispatch.rs
+++ b/workflows/src/dispatch.rs
@@ -95,7 +95,7 @@ pub(crate) fn build_task_prompt(task: &Task) -> String {
          (<slug> is a short kebab-case summary of the task title)"
     ));
     lines.push(format!(
-        "2. hub task link {id} ~/.hub/agent-session-logs/{id}-<slug>.md"
+        "2. hub task link {id} --value ~/.hub/agent-session-logs/{id}-<slug>.md"
     ));
     lines.push(format!("3. hub task report {id} --status in-review"));
     lines.push(String::new());
@@ -935,5 +935,13 @@ mod tests {
             completion_section.contains("hub task report TASK-0099 --status in-review"),
             "completion steps must include the full report command"
         );
+        // The link command requires the --value flag; without it the CLI
+        // rejects a bare path argument, so the injected instruction must match.
+        assert!(
+            completion_section.contains(
+                "hub task link TASK-0099 --value ~/.hub/agent-session-logs/TASK-0099-<slug>.md"
+            ),
+            "completion steps must use the --value flag for the link command"
+        );
     }
 }