@@ -149,6 +149,14 @@ export class WorkspaceApiError extends Error {
   }
 }
 
+/** A credential captured once and passed to every request of one flow, so the flow cannot
+ * drift onto another account part-way: workspace and user ids are per tenant. */
+export interface ActAs {
+  url: string
+  instance: string
+  apiKey: string
+}
+
 async function creds(): Promise<{ url: string; instance: string; apiKey: string }> {
   if (!(await AltimateApi.isConfigured())) throw new NotConfiguredError()
   const c = await AltimateApi.getCredentials()
@@ -511,23 +519,31 @@ export namespace WorkspaceApi {
     return { id, name: input.name }
   }
 
+  /** The ambient credential as an `ActAs`, or null when none is configured. */
+  export async function captureCredentials(): Promise<ActAs | null> {
+    return creds().catch(() => null)
+  }
+
   export async function bindExisting(
     datamateId: number,
     identifier: ProjectIdentifier,
+    actAs?: ActAs,
   ): Promise<BindingResponse> {
     return req<BindingResponse>("POST", "/bind", {
       body: {
         datamate_id: datamateId,
         repo_remote: identifier.repoRemote ?? null,
         project_path: identifier.projectPath ?? null,
       },
+      ...(actAs ? { actAs } : {}),
     })
   }
 
   export async function rebindByRemote(input: {
     remote: string
     targetDatamateId: number
     expectedCurrentDatamateId?: number
+    actAs?: ActAs
   }): Promise<BindingResponse> {
     return req<BindingResponse>("PUT", "/by-remote", {
       body: {
@@ -537,6 +553,7 @@ export namespace WorkspaceApi {
           ? { expected_current_datamate_id: input.expectedCurrentDatamateId }
           : {}),
       },
+      ...(input.actAs ? { actAs: input.actAs } : {}),
     })
   }
 
@@ -546,6 +563,7 @@ export namespace WorkspaceApi {
     projectPath: string
     targetDatamateId: number
     expectedCurrentDatamateId?: number
+    actAs?: ActAs
   }): Promise<BindingResponse> {
     return req<BindingResponse>("PUT", "/by-path", {
       body: {
@@ -555,6 +573,7 @@ export namespace WorkspaceApi {
           ? { expected_current_datamate_id: input.expectedCurrentDatamateId }
           : {}),
       },
+      ...(input.actAs ? { actAs: input.actAs } : {}),
     })
   }
 
@@ -617,8 +636,8 @@ export namespace WorkspaceApi {
   /** The caller's own user id, from ``GET /users/me``. Needed wherever the
    * client must compare ownership — skill attachment requires the caller to
    * OWN the workspace, and the credentials carry no user id of their own. */
-  export async function whoami(): Promise<number> {
-    const me = await req<{ id?: unknown }>("GET", "/me", { base: "/users" })
+  export async function whoami(actAs?: ActAs): Promise<number> {
+    const me = await req<{ id?: unknown }>("GET", "/me", { base: "/users", ...(actAs ? { actAs } : {}) })
     const id = Number(me?.id)
     if (!Number.isInteger(id) || id <= 0) throw new WorkspaceApiError("The server did not say who this account is.")
     return id
 
@@ -1095,7 +1095,13 @@ export async function currentScope(): Promise<{ tenant: string; apiUrl: string }
 export async function accountDigest(): Promise<string | null> {
   const c = await AltimateApi.getCredentials().catch(() => null)
   if (!c?.altimateApiKey || !c.altimateInstanceName || !c.altimateUrl) return null
-  return createHash("sha256").update(`${c.altimateUrl}|${c.altimateInstanceName}|${c.altimateApiKey}`).digest("hex")
+  return digestOf({ url: c.altimateUrl, instance: c.altimateInstanceName, apiKey: c.altimateApiKey })
+}
+
+/** `accountDigest` for a credential already captured, so a flow can pin its record and seed
+ * to the account its requests ran as. */
+export function digestOf(c: { url: string; instance: string; apiKey: string }): string {
+  return createHash("sha256").update(`${c.url}|${c.instance}|${c.apiKey}`).digest("hex")
 }
 
 export async function recordApprovedBinding(
 
@@ -24,6 +24,7 @@ import {
   NotConfiguredError,
   NotFoundError,
   PreconditionFailedError,
+  type ActAs,
   type Binding,
   type DatamateRef,
   type MatchedIdentifier,
@@ -41,7 +42,7 @@ import {
   resolveWorkspaceWebUrl,
   type HandoffResult,
 } from "@/altimate/workspace/browser-handoff"
-import { accountDigest, recordApprovedBinding } from "@/altimate/workspace/state"
+import { accountDigest, digestOf, recordApprovedBinding } from "@/altimate/workspace/state"
 import type { SeedOutcome } from "@/altimate/workspace/memory-backfill"
 import {
   confirmsNamesake,
@@ -243,11 +244,19 @@ export const LinkCommand = cmd({
       )
     }
 
+    // One credential for the list, the owner lookup and the bind: workspace and user ids are
+    // per tenant, so a switch while the picker is open must not mix two accounts.
+    const actAs = await WorkspaceApi.captureCredentials()
+    if (!actAs) {
+      prompts.log.error("Could not read your Altimate credentials. Check /connect and try again.")
+      process.exitCode = 1
+      return
+    }
     const spin = prompts.spinner()
     spin.start("Loading workspaces...")
     let list: DatamateRef[]
     try {
-      list = await WorkspaceApi.listDatamates()
+      list = await WorkspaceApi.listDatamates(actAs)
     } catch (err) {
       spin.stop("Could not load workspaces.", 1)
       prompts.log.error(err instanceof Error ? err.message : String(err))
@@ -263,7 +272,7 @@ export const LinkCommand = cmd({
     // Listed workspaces already named what a quick create would use. The picker opens on
     // the caller's own (never a colleague's), and creating another namesake is confirmed.
     // Without a user id nothing is preselected; the confirmation still applies.
-    const userId = await WorkspaceApi.whoami().catch(() => undefined)
+    const userId = await WorkspaceApi.whoami(actAs).catch(() => undefined)
     const namesakes = findNamesakes(list, autoName, userId)
     // Sanitized once here so every downstream display (the picker message,
     // the "Kept" outro, hyperlink()'s own text) is covered — hyperlink()
@@ -381,7 +390,7 @@ export const LinkCommand = cmd({
       return
     }
 
-    await bindOrRebind(identifier, targetId, existing, preCheckOk, args.directory)
+    await bindOrRebind(identifier, targetId, existing, preCheckOk, args.directory, actAs)
   },
 })
 
@@ -712,12 +721,13 @@ async function bindOrRebind(
   existing: ProjectBindingLookup | null,
   preCheckOk: boolean,
   directory: string,
+  /** The credential the picker's list was read as. The bind runs as it, and the seed refuses
+   * (account-changed) if the configured account switches mid-way. */
+  actAs: ActAs,
 ): Promise<void> {
-  // The account this bind acts as; the seed refuses (account-changed) if it switches mid-way.
-  // Unreadable credentials cannot link anyway, and must not leave the bind unguarded.
-  const linkAccount = await accountDigest()
-  if (linkAccount === null) {
-    prompts.log.error("Could not read your Altimate credentials, so nothing was linked. Check /connect and try again.")
+  const linkAccount = digestOf(actAs)
+  if ((await accountDigest()) !== linkAccount) {
+    prompts.log.error("Your Altimate account changed since the list was loaded, so nothing was linked. Re-run `altimate-code link`.")
     process.exitCode = 1
     return
   }
@@ -732,13 +742,14 @@ async function bindOrRebind(
         targetDatamateId,
         expectedCurrentDatamateId: existing.datamate.id,
         matchedBy: existing.matchedBy,
+        actAs,
       })
     } else {
       // No known binding OR pre-check failed. Try bindExisting first — if the
       // pre-check missed a real binding, the server will 409, and we retry as
       // rebind when we're allowed to. (m10)
       try {
-        res = await WorkspaceApi.bindExisting(targetDatamateId, identifier)
+        res = await WorkspaceApi.bindExisting(targetDatamateId, identifier, actAs)
       } catch (err) {
         // A teammate's private workspace is not a pre-check race: rebinding it only fails
         // again (forbidden), and would hide the explanation the outer handler gives.
@@ -767,11 +778,13 @@ async function bindOrRebind(
               res = await WorkspaceApi.rebindByPath({
                 projectPath: conflictPath,
                 targetDatamateId,
+                actAs,
               })
             } else if (conflictRemote) {
               res = await WorkspaceApi.rebindByRemote({
                 remote: conflictRemote,
                 targetDatamateId,
+                actAs,
               })
             } else {
               // Server didn't tell us which identifier owned the conflict —
@@ -781,10 +794,12 @@ async function bindOrRebind(
                 ? await WorkspaceApi.rebindByRemote({
                     remote: identifier.repoRemote,
                     targetDatamateId,
+                    actAs,
                   })
                 : await WorkspaceApi.rebindByPath({
                     projectPath: identifier.projectPath!,
                     targetDatamateId,
+                    actAs,
                   })
             }
             rebindSpin.stop(`Re-linked to "${stripControlChars(res.binding.datamate_name)}".`)
@@ -871,19 +886,22 @@ async function rebindByMatchedIdentifier(input: {
   targetDatamateId: number
   expectedCurrentDatamateId: number
   matchedBy: MatchedIdentifier
+  actAs?: ActAs
 }) {
   if (input.matchedBy === "remote" && input.identifier.repoRemote) {
     return WorkspaceApi.rebindByRemote({
       remote: input.identifier.repoRemote,
       targetDatamateId: input.targetDatamateId,
       expectedCurrentDatamateId: input.expectedCurrentDatamateId,
+      actAs: input.actAs,
     })
   }
   if (input.matchedBy === "path" && input.identifier.projectPath) {
     return WorkspaceApi.rebindByPath({
       projectPath: input.identifier.projectPath,
       targetDatamateId: input.targetDatamateId,
       expectedCurrentDatamateId: input.expectedCurrentDatamateId,
+      actAs: input.actAs,
     })
   }
   throw new Error(