diff --git a/.github/workflows/gate-attestation.yml b/.github/workflows/gate-attestation.yml
index e145ad8..87629c1 100644
--- a/.github/workflows/gate-attestation.yml
+++ b/.github/workflows/gate-attestation.yml
@@ -85,7 +85,12 @@ permissions:
 
 jobs:
   gate:
-    uses: forkwright/.github/.github/workflows/hybrid-gate.yml@main
+    # WHY pinned to a commit SHA, not @main: a mutable branch ref lets the
+    # remote workflow's behavior change under an already-merged hamma
+    # commit. Refresh via:
+    #   gh api repos/forkwright/.github/commits/main --jq '.sha'
+    # and review the diff at forkwright/.github before bumping.
+    uses: forkwright/.github/.github/workflows/hybrid-gate.yml@df92942bcc41cc7ffd0339b75b2f01e52269d0ef # main
     with:
       # WHY defaults kept as-is: hamma has its own rust-toolchain.toml
       # (channel = "1.88") -- auto-detect applies, no rust_toolchain
diff --git a/.kanon-lint-ignore b/.kanon-lint-ignore
index fcbb18c..aabdfd8 100644
--- a/.kanon-lint-ignore
+++ b/.kanon-lint-ignore
@@ -28,8 +28,8 @@ RUST/pub-visibility:crates/mitos/src/config/**
 # the future histos coordination server. These items are library API by design — the
 # pub modules in lib.rs re-export them. Narrowing to pub(crate) would break both the
 # example and the integration test, which live in separate compilation units.
-RUST/pub-visibility:crates/dictyon/src/control.rs
-RUST/pub-visibility:crates/dictyon/src/noise.rs
+RUST/pub-visibility:crates/dictyon/src/control/**
+RUST/pub-visibility:crates/dictyon/src/noise/**
 RUST/pub-visibility:crates/dictyon/src/transport.rs
 RUST/pub-visibility:crates/dictyon/src/wire/**