diff --git a/.github/workflows/quality-gates.yml b/.github/workflows/quality-gates.yml
index c488165..eda6573 100644
--- a/.github/workflows/quality-gates.yml
+++ b/.github/workflows/quality-gates.yml
@@ -75,7 +75,7 @@ jobs:
       actions: read
     # attested-delivery/.github main @ ca91728 (2026-06-23)
     uses: >-
-      attested-delivery/.github/.github/workflows/reusable-scorecard.yml@ca91728c87beb08742325b4ed4d06fcfb261435b
+      attested-delivery/.github/.github/workflows/reusable-scorecard.yml@ee1f93b566abc109efa0588d3d5308b4dd4a7492
 
   # IaC + license — Trivy filesystem scan (Dockerfile, manifests, licenses).
   # No image-ref: the container is gated by `publish = false` (template state).