diff --git a/.github/workflows/gate-attestation.yml b/.github/workflows/gate-attestation.yml
index e6e8f30..4d80214 100644
--- a/.github/workflows/gate-attestation.yml
+++ b/.github/workflows/gate-attestation.yml
@@ -58,7 +58,11 @@ permissions:
 
 jobs:
   gate:
-    uses: forkwright/.github/.github/workflows/hybrid-gate.yml@d74efb1d2d87ec86717dad5d42d468f6e3cf7994 # main
+    # WHY @main, not a pinned SHA: forkwright/.github publishes no tags, so a
+    # SHA pin here has no dependabot bump path and just freezes. forkwright/
+    # .github is first-party -- same org, same trust boundary -- not the
+    # third-party supply-chain case a SHA pin defends against.
+    uses: forkwright/.github/.github/workflows/hybrid-gate.yml@main
     with:
       fmt_cmd: "cargo fmt --all -- --check"
       check_cmd: "cargo check --workspace --all-targets"
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 0920fe7..b259e96 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -17,6 +17,9 @@ permissions:
 
 jobs:
   release-please:
+    # WHY @main: forkwright/.github publishes no tags, so a SHA pin here would
+    # have no dependabot bump path and would just freeze. First-party,
+    # same-org reusable; fleet convention pins it @main.
     uses: forkwright/.github/.github/workflows/release-please.yml@main
     secrets:
       RELEASE_PLEASE_TOKEN: ${{ secrets.RELEASE_PLEASE_TOKEN }}