diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index afcffe4..2095d15 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,12 +26,11 @@ jobs:
     permissions:
       contents: read
     uses: >-
-      attested-delivery/.github/.github/workflows/pin-check.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
-
+      attested-delivery/.github/.github/workflows/pin-check.yml@f211de97395ced798da52e28d89d79c22b3020ee
   # Centralized, verified actionlint fetch.
   # attested-delivery/.github @ b314c29 (#6 — in-step PATH fix)
   validate-workflows:
     permissions:
       contents: read
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-actionlint.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-actionlint.yml@f211de97395ced798da52e28d89d79c22b3020ee
\ No newline at end of file
diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index 7993641..e3ce55d 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -40,7 +40,7 @@ jobs:
       actions: read
       packages: read
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       languages: actions
       build-mode: none
@@ -52,7 +52,7 @@ jobs:
       security-events: write
       pull-requests: write
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       fail-on-severity: high
 
@@ -63,7 +63,7 @@ jobs:
       actions: read
       packages: read
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       scan-iac: true
 
@@ -75,7 +75,7 @@ jobs:
       contents: read
       actions: read
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-scorecard.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-scorecard.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       publish-results: false
 
@@ -85,15 +85,14 @@ jobs:
       contents: read
       security-events: write
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
-
+      attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee
   semgrep:
     permissions:
       contents: read
       security-events: write
       actions: read
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       directory: .
 
@@ -103,7 +102,7 @@ jobs:
       security-events: write
       actions: read
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       directory: .
 
@@ -113,7 +112,7 @@ jobs:
       security-events: write
       actions: read
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       directory: .
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ff096a9..6174779 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,47 +137,46 @@ jobs:
     needs: [meta]
     permissions: { security-events: write, contents: read, actions: read, packages: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-sast-codeql.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with: { languages: actions, build-mode: none }
   gate-sca:
     needs: [meta]
     permissions: { actions: read, contents: read, security-events: write, pull-requests: write }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-sca-osv.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with: { fail-on-severity: high }
   gate-trivy:
     needs: [meta]
     permissions: { contents: read, security-events: write, actions: read, packages: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-trivy.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with: { scan-iac: true }
   gate-shellcheck:
     needs: [meta]
     permissions: { contents: read, security-events: write }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-shellcheck.yml@f211de97395ced798da52e28d89d79c22b3020ee
   gate-semgrep:
     needs: [meta]
     permissions: { contents: read, security-events: write, actions: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-semgrep.yml@f211de97395ced798da52e28d89d79c22b3020ee
   gate-secrets:
     needs: [meta]
     permissions: { contents: read, security-events: write, actions: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-secrets.yml@f211de97395ced798da52e28d89d79c22b3020ee
   gate-manifest:
     needs: [meta]
     permissions: { contents: read, security-events: write, actions: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
-
+      attested-delivery/.github/.github/workflows/reusable-manifest-review.yml@f211de97395ced798da52e28d89d79c22b3020ee
   # --- seam attestations: bind each verdict to the tarball digest -------------
   attest-sast:
     needs: [meta, build, gate-sast]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}
@@ -188,7 +187,7 @@ jobs:
     needs: [meta, build, gate-sca]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}
@@ -199,7 +198,7 @@ jobs:
     needs: [meta, build, gate-trivy]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}
@@ -210,7 +209,7 @@ jobs:
     needs: [meta, build, gate-shellcheck]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}
@@ -221,7 +220,7 @@ jobs:
     needs: [meta, build, gate-semgrep]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}
@@ -232,7 +231,7 @@ jobs:
     needs: [meta, build, gate-secrets]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}
@@ -243,7 +242,7 @@ jobs:
     needs: [meta, build, gate-manifest]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-attest-scan.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}
@@ -256,7 +255,7 @@ jobs:
     needs: [meta]
     permissions: { id-token: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-cosign-sign.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       blob-path: .claude-plugin/marketplace.json
 
@@ -265,7 +264,7 @@ jobs:
     needs: [meta, build]
     permissions: { id-token: write, attestations: write, contents: read }
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-vex.yml@f211de97395ced798da52e28d89d79c22b3020ee # v0.1.0
+      attested-delivery/.github/.github/workflows/reusable-vex.yml@f211de97395ced798da52e28d89d79c22b3020ee
     with:
       subject-name: ${{ needs.build.outputs.subject-name }}
       subject-digest: ${{ needs.build.outputs.subject-digest }}