diff --git a/.github/workflows/elixir-ci.yml.rej b/.github/workflows/elixir-ci.yml.rej
new file mode 100644
index 0000000..8a6c1fa
--- /dev/null
+++ b/.github/workflows/elixir-ci.yml.rej
@@ -0,0 +1,11 @@
+--- .github/workflows/elixir-ci.yml
++++ .github/workflows/elixir-ci.yml
+@@ -19,7 +19,7 @@ permissions:
+ 
+ jobs:
+   elixir-ci:
+-    uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
++    uses: hyperpolymath/standards/.github/workflows/elixir-ci-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+     with:
+       otp-version: "27.2.1"
+       elixir-version: "1.18.2"
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 76a63ca..ef57260 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -31,4 +31,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
diff --git a/.github/workflows/governance.yml.orig b/.github/workflows/governance.yml.orig
new file mode 100644
index 0000000..76a63ca
--- /dev/null
+++ b/.github/workflows/governance.yml.orig
@@ -0,0 +1,34 @@
+# SPDX-License-Identifier: MPL-2.0
+# governance.yml — single wrapper calling the shared estate governance bundle
+# in hyperpolymath/standards instead of carrying per-repo copies.
+#
+# Replaces the per-repo governance scaffolding removed in the same commit:
+#   quality.yml, guix-guix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml,
+#   security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml,
+#   workflow-linter.yml
+#
+# Load-bearing build/security workflows stay standalone in the repo
+# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
+
+name: Governance
+
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+  workflow_dispatch:
+
+# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
+# updates do not pile up queued runs against the shared account-wide
+# Actions concurrency pool. Applied only to read-only check workflows
+# (no publish/mutation), so cancelling a superseded run is always safe.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  governance:
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
diff --git a/.github/workflows/governance.yml.rej b/.github/workflows/governance.yml.rej
new file mode 100644
index 0000000..faf27ee
--- /dev/null
+++ b/.github/workflows/governance.yml.rej
@@ -0,0 +1,7 @@
+--- .github/workflows/governance.yml
++++ .github/workflows/governance.yml
+@@ -31,4 +31,4 @@ permissions:
+ 
+ jobs:
+   governance:
+-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
\ No newline at end of file
diff --git a/.github/workflows/mirror.yml.rej b/.github/workflows/mirror.yml.rej
new file mode 100644
index 0000000..c4879e9
--- /dev/null
+++ b/.github/workflows/mirror.yml.rej
@@ -0,0 +1,9 @@
+--- .github/workflows/mirror.yml
++++ .github/workflows/mirror.yml
+@@ -11,5 +11,5 @@ permissions:
+ 
+ jobs:
+   mirror:
+-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
++    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 20a29ea..b1c4cc9 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -6,12 +6,15 @@ on:
   schedule:
     - cron: '23 4 * * 1'
 
-permissions: read-all
+permissions:
+  contents: read
+  security-events: write
+  id-token: write
 
 jobs:
   analysis:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml.orig b/.github/workflows/scorecard.yml.orig
new file mode 100644
index 0000000..20a29ea
--- /dev/null
+++ b/.github/workflows/scorecard.yml.orig
@@ -0,0 +1,17 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Scorecards supply-chain security
+
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: '23 4 * * 1'
+
+permissions: read-all
+
+jobs:
+  analysis:
+    permissions:
+      security-events: write
+      id-token: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    secrets: inherit
diff --git a/.github/workflows/scorecard.yml.rej b/.github/workflows/scorecard.yml.rej
new file mode 100644
index 0000000..a3c95fb
--- /dev/null
+++ b/.github/workflows/scorecard.yml.rej
@@ -0,0 +1,22 @@
+--- .github/workflows/scorecard.yml
++++ .github/workflows/scorecard.yml
+@@ -6,12 +6,14 @@ on:
+   schedule:
+     - cron: '23 4 * * 1'
+ 
+-permissions: read-all
+-
++permissions:
++  contents: read
++  security-events: write
++  id-token: write
+ jobs:
+   analysis:
+     permissions:
+-      security-events: write
+-      id-token: write
+-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
++  contents: read
++  security-events: write
++  id-token: write    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
+     secrets: inherit
\ No newline at end of file
diff --git a/.github/workflows/secret-scanner.yml.orig b/.github/workflows/secret-scanner.yml.orig
new file mode 100644
index 0000000..7ccae92
--- /dev/null
+++ b/.github/workflows/secret-scanner.yml.orig
@@ -0,0 +1,21 @@
+# SPDX-License-Identifier: MPL-2.0
+name: Secret Scanner
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    permissions:
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+    secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml.rej b/.github/workflows/secret-scanner.yml.rej
new file mode 100644
index 0000000..30ff515
--- /dev/null
+++ b/.github/workflows/secret-scanner.yml.rej
@@ -0,0 +1,9 @@
+--- .github/workflows/secret-scanner.yml
++++ .github/workflows/secret-scanner.yml
+@@ -17,5 +17,5 @@ jobs:
+   scan:
+     permissions:
+       contents: read
+-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
++    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@892497fe373744874316710966b81ae6f0ea9e66
+     secrets: inherit
\ No newline at end of file