diff --git a/.changes/review/host-run-12505-round3-read-tool-3c9e41a7.md b/.changes/review/host-run-12505-round3-read-tool-3c9e41a7.md
new file mode 100644
index 00000000000..6045d6702fb
--- /dev/null
+++ b/.changes/review/host-run-12505-round3-read-tool-3c9e41a7.md
@@ -0,0 +1,7 @@
+---
+bump: patch
+---
+
+### Fixed
+
+- The `code-reviewer` agent now reads its bundled files (`context/severity.md`, the quality-gate code-design criteria and the other `${CLAUDE_PLUGIN_ROOT}` files it names) with the `Read` tool instead of a shell `cat` or `sed`. Shell reads of those files were denied in eval runs, which made the reviewer-diversity suites invalid.
diff --git a/plugins/review/agents/code-reviewer.md b/plugins/review/agents/code-reviewer.md
index 00e67172fa3..a8817302102 100644
--- a/plugins/review/agents/code-reviewer.md
+++ b/plugins/review/agents/code-reviewer.md
@@ -82,6 +82,8 @@ The cap is `maxTurns: 30` and a large change set can exhaust it. Finish reading
 
 The mutable-state scope, repeat-run, side-effect, boundary re-check and cast-or-debug-output items above are SUGGESTION findings; raise one higher only when the change shows the behavior it causes is wrong.
 
+**Bundled files.** Read each `${CLAUDE_PLUGIN_ROOT}` file this page names with the `Read` tool, never through Bash (`cat`, `sed`, `grep`): it sits outside the repository under review.
+
 **Type questions.** When the diff declares or changes a type, or a finding turns on how a value is typed, read `${CLAUDE_PLUGIN_ROOT}/context/type-discipline.md` and judge the type against its matching row. A change that departs from that row is a SUGGESTION finding citing the row, raised higher only when the change shows the behavior it causes is wrong; the items above still apply as written.
 
 **Design-smell baseline** (Fowler, *Refactoring* 2nd ed., ch. 3). Check the diff for the smells below and report a match as a possible smell, not a rule violation. Where the project's documented standards endorse a pattern a smell would flag, the standards win; a pattern any tooling already enforces (a linter, formatter, compiler setting, architecture test, or another automated check) is not reported: