diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 365464f..6e3bce0 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -3,6 +3,12 @@
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.2'
 workflows:
+    '.github/workflows/governance.yml': []
+    '.github/workflows/hypatia-scan.yml': []
+    '.github/workflows/mirror.yml': []
+    '.github/workflows/rust-ci.yml': []
+    '.github/workflows/scorecard.yml': []
+    '.github/workflows/secret-scanner.yml': []
     '.github/workflows/boj-build.yml':
         - 'actions/checkout@v4.1.7'
     '.github/workflows/cargo-audit.yml':
@@ -77,10 +83,12 @@ workflows:
         - 'actions/download-artifact@v4.1.8'
         - 'actions/setup-node@v4.0.2'
         - 'actions/upload-artifact@v4.6.2'
-        - 'dtolnay/rust-toolchain@master'
+        - 'dtolnay/rust-toolchain@v1'
         - 'goto-bus-stop/setup-zig@v2.2.1'
         - 'softprops/action-gh-release@v2.2.1'
-    '.github/workflows/stress-test.yml': []
+    '.github/workflows/stress-test.yml':
+        - 'actions/checkout@v6.0.1'
+        - 'dtolnay/rust-toolchain@v1'
     '.github/workflows/workflow-linter.yml':
         - 'actions/checkout@v4.1.1'
     '.github/workflows/zig-ffi.yml':
@@ -88,7 +96,7 @@ workflows:
         - 'actions/checkout@v6.0.1'
         - 'actions/upload-artifact@v4.6.2'
         - 'denoland/setup-deno@v1.5.2'
-        - 'dtolnay/rust-toolchain@master'
+        - 'dtolnay/rust-toolchain@v1'
         - 'goto-bus-stop/setup-zig@v2.2.1'
 dependencies:
     'actions/attest-build-provenance@1176ef556905f349f669722abf30bce1a6e16e01':
@@ -188,7 +196,7 @@ dependencies:
         repo_id: 212301524
     'dawidd6/action-send-mail@v3.12.0':
         ref: 'v3.12.0'
-        commit: 'sha1-6e502825a508b867ab2954ad6343b68787624c01'
+        commit: 'sha1-2cea9617b09d79a095af21254fbcb7ae95903dde'
         owner_id: 9713907
         repo_id: 222439721
     'denoland/setup-deno@v1.5.2':
@@ -216,9 +224,9 @@ dependencies:
         commit: 'sha1-8e5442c4ef9f78752691e2d8f8d19755c6f78e81'
         owner_id: 5429470
         repo_id: 306769011
-    'dtolnay/rust-toolchain@master':
-        ref: 'master'
-        commit: 'sha1-0b1efabc08b657293548b77fb76cc02d26091c7e'
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772'
         owner_id: 1940490
         repo_id: 260749683
     'github/codeql-action@v4.34.0':
@@ -243,12 +251,12 @@ dependencies:
         repo_id: 623796603
     'hyperpolymath/a2ml-ecosystem@main':
         ref: 'main'
-        commit: 'sha1-aa4b836bd969df2bc58128cb8e3d20bbc88d5e79'
+        commit: 'sha1-c572785aab3898d9955f9e0370439631265802c9'
         owner_id: 6759885
         repo_id: 1275649586
     'hyperpolymath/k9-ecosystem@main':
         ref: 'main'
-        commit: 'sha1-89f3c2702f4f650a92aa7411502f38da06abd562'
+        commit: 'sha1-921f599d0b5bc6de4627338b014059ab6bcea5b8'
         owner_id: 6759885
         repo_id: 1275650185
     'ksxgithub/github-actions-deploy-aur@v3.0.1':
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index d463e57..dc5e072 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: BoJ Server Build Trigger
 on:
   push:
@@ -11,7 +12,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@v4.1.7
       - name: Trigger BoJ Server (Casket/ssg-mcp)
         run: |
           # Send a secure trigger to boj-server to build this repository
diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index 5130c58..355ab21 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Prevention workflow - audits Rust dependencies for vulnerabilities
 name: Cargo Audit
 
@@ -23,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4.1.1
 
       - name: Install cargo-audit
         run: cargo install cargo-audit --locked
@@ -43,7 +44,7 @@ jobs:
     permissions:
       issues: write
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4.1.1
 
       - name: Create vulnerability issue
         env:
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index ed4df2b..f107d52 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:
@@ -22,22 +23,22 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@v4.1.1
 
       - name: Checkout casket-ssg
-        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        uses: actions/checkout@v4.1.1
         with:
           repository: hyperpolymath/casket-ssg
           path: .casket-ssg
 
       - name: Setup GHCup
-        uses: haskell-actions/setup@ec49483bfc012387b227434aba94f59a6ecd0900 # v2.7.5
+        uses: haskell-actions/setup@v2.7.5
         with:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
 
       - name: Cache Cabal
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@v4.3.0
         with:
           path: |
             ~/.cabal/packages
@@ -99,10 +100,10 @@ jobs:
           touch ../_site/.nojekyll
 
       - name: Setup Pages
-        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
+        uses: actions/configure-pages@v5.0.0
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@v3.0.1
         with:
           path: '_site'
 
@@ -116,4 +117,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+        uses: actions/deploy-pages@v4.0.5
diff --git a/.github/workflows/cflite_batch.yml b/.github/workflows/cflite_batch.yml
index 763bb84..b83d1bc 100644
--- a/.github/workflows/cflite_batch.yml
+++ b/.github/workflows/cflite_batch.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: ClusterFuzzLite batch fuzzing
 on:
   schedule:
@@ -20,14 +21,14 @@ jobs:
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
-        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
           language: rust
           sanitizer: ${{ matrix.sanitizer }}
 
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         id: run
-        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           fuzz-seconds: 1800
diff --git a/.github/workflows/cflite_pr.yml b/.github/workflows/cflite_pr.yml
index d0e808b..1d3eccc 100644
--- a/.github/workflows/cflite_pr.yml
+++ b/.github/workflows/cflite_pr.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: ClusterFuzzLite PR fuzzing
 on:
   pull_request:
@@ -19,14 +20,14 @@ jobs:
     steps:
       - name: Build Fuzzers (${{ matrix.sanitizer }})
         id: build
-        uses: google/clusterfuzzlite/actions/build_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/build_fuzzers@v1
         with:
           language: rust
           sanitizer: ${{ matrix.sanitizer }}
 
       - name: Run Fuzzers (${{ matrix.sanitizer }})
         id: run
-        uses: google/clusterfuzzlite/actions/run_fuzzers@884713a6c30a92e5e8544c39945cd7cb630abcd1 # v1
+        uses: google/clusterfuzzlite/actions/run_fuzzers@v1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           fuzz-seconds: 300
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 77f8978..af28e2e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:
@@ -37,15 +38,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
+        uses: github/codeql-action/init@v4.34.0
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@c6f931105cb2c34c8f901cc885ba1e2e259cf745 # v4.34.0
+        uses: github/codeql-action/analyze@v4.34.0
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 727fed3..f891833 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 #
 # dependabot-automerge.yml — enable GitHub's native auto-merge on
 # Dependabot pull requests that match a declared severity / ecosystem
@@ -56,7 +57,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@dbb049abf0d677abbd7f7eee0375145b417fdd34 # v2.2.0
+        uses: dependabot/fetch-metadata@v2.2.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/dogfood-gate.yml b/.github/workflows/dogfood-gate.yml
index f1c6c01..9cb6055 100644
--- a/.github/workflows/dogfood-gate.yml
+++ b/.github/workflows/dogfood-gate.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Copyright (c) 2026 Jonathan D.A. Jewell (hyperpolymath) <j.d.a.jewell@open.ac.uk>
 #
 # dogfood-gate.yml — Hyperpolymath Dogfooding Quality Gate
@@ -27,7 +28,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
 
       - name: Check for A2ML files
         id: detect
@@ -40,7 +41,7 @@ jobs:
 
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-ecosystem/validate-action@c572785aab3898d9955f9e0370439631265802c9 # main
+        uses: hyperpolymath/a2ml-ecosystem/validate-action@main
         with:
           path: '.'
           strict: 'false'
@@ -72,7 +73,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
 
       - name: Check for K9 files
         id: detect
@@ -89,7 +90,7 @@ jobs:
 
       - name: Validate K9 contracts
         if: steps.detect.outputs.k9_count > 0
-        uses: hyperpolymath/k9-ecosystem/validate-action@921f599d0b5bc6de4627338b014059ab6bcea5b8 # main
+        uses: hyperpolymath/k9-ecosystem/validate-action@main
         with:
           path: '.'
           strict: 'false'
@@ -122,7 +123,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
 
       - name: Scan for invisible characters
         id: lint
@@ -187,7 +188,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
 
       - name: Check for Groove manifest
         id: groove
@@ -246,7 +247,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
 
       - name: Check and validate eclexiaiser manifest
         id: eclex
@@ -312,7 +313,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+        uses: actions/checkout@v4.3.1
 
       - name: Generate dogfooding scorecard
         run: |
diff --git a/.github/workflows/generator-generic-ossf-slsa3-publish.yml b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
index 15debbe..c542ec0 100644
--- a/.github/workflows/generator-generic-ossf-slsa3-publish.yml
+++ b/.github/workflows/generator-generic-ossf-slsa3-publish.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # This workflow uses actions that are not certified by GitHub.
 # They are provided by a third-party and are governed by
 # separate terms of service, privacy policy, and support
@@ -30,7 +31,7 @@ jobs:
       digests: ${{ steps.hash.outputs.digests }}
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       # ========================================================
       #
diff --git a/.github/workflows/ghcr-publish.yml b/.github/workflows/ghcr-publish.yml
index c783a60..d47d54f 100644
--- a/.github/workflows/ghcr-publish.yml
+++ b/.github/workflows/ghcr-publish.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish to GHCR
 
 permissions:
@@ -24,7 +25,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
 
       - name: Install nerdctl and containerd
         run: |
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index be3d7df..be5d5f2 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Governance
 
 on:
@@ -10,8 +11,9 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index da2e480..23785f3 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan
 
 on:
@@ -12,9 +13,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 2bedb70..a793d02 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 
@@ -18,7 +19,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Propagation
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.FARM_DISPATCH_TOKEN }}
           repository: hyperpolymath/.git-private-farm
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 548569b..c2ba777 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 
 on:
@@ -8,9 +9,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     secrets: inherit
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 8e34a8b..098f7d6 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
@@ -20,9 +21,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@v4.4.0
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@v4.4.0
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -39,7 +40,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
+        uses: actions/upload-pages-artifact@v3.0.1
         with:
           path: '_site'
   deploy:
@@ -52,4 +53,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+        uses: actions/deploy-pages@v4.0.5
diff --git a/.github/workflows/publish-aur.yml b/.github/workflows/publish-aur.yml
index d689d1d..caf9706 100644
--- a/.github/workflows/publish-aur.yml
+++ b/.github/workflows/publish-aur.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish AUR
 
 on:
@@ -41,7 +42,7 @@ jobs:
 
       - name: Checkout bunsenite
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
 
       - name: Get inputs
         if: steps.check-secret.outputs.skip != 'true'
@@ -102,7 +103,7 @@ jobs:
 
       - name: Publish to AUR
         if: steps.check-secret.outputs.skip != 'true'
-        uses: KSXGitHub/github-actions-deploy-aur@a97f56a8425a7a7f3b8c58607f769c69b089cadb # v3.0.1
+        uses: KSXGitHub/github-actions-deploy-aur@v3.0.1
         with:
           pkgname: bunsenite-bin
           pkgbuild: aur-package/PKGBUILD
diff --git a/.github/workflows/publish-chocolatey.yml b/.github/workflows/publish-chocolatey.yml
index cbefd2c..67dea2e 100644
--- a/.github/workflows/publish-chocolatey.yml
+++ b/.github/workflows/publish-chocolatey.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Chocolatey
 
 on:
@@ -39,7 +40,7 @@ jobs:
 
       - name: Checkout bunsenite
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
 
       - name: Get inputs
         if: steps.check-secret.outputs.skip != 'true'
diff --git a/.github/workflows/publish-container.yml b/.github/workflows/publish-container.yml
index 2c0bb34..566c530 100644
--- a/.github/workflows/publish-container.yml
+++ b/.github/workflows/publish-container.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Container
 
 on:
@@ -21,10 +22,10 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
       
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+        uses: docker/login-action@v3.3.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -32,7 +33,7 @@ jobs:
       
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@8e5442c4ef9f78752691e2d8f8d19755c6f78e81 # v5.5.1
+        uses: docker/metadata-action@v5.5.1
         with:
           images: ghcr.io/${{ github.repository }}
           tags: |
@@ -43,7 +44,7 @@ jobs:
       
       - name: Build and push
         id: push
-        uses: docker/build-push-action@4f58ea79222b3b9dc2c8bbdd6debcef730109a75 # v6.9.0
+        uses: docker/build-push-action@v6.9.0
         with:
           context: .
           file: ./Containerfile
@@ -52,7 +53,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Attest container provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        uses: actions/attest-build-provenance@v2.4.0
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/publish-copr.yml b/.github/workflows/publish-copr.yml
index 2694f90..d5ab03b 100644
--- a/.github/workflows/publish-copr.yml
+++ b/.github/workflows/publish-copr.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish COPR
 
 on:
@@ -81,7 +82,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-debian-ppa.yml b/.github/workflows/publish-debian-ppa.yml
index a7f71d8..64dd934 100644
--- a/.github/workflows/publish-debian-ppa.yml
+++ b/.github/workflows/publish-debian-ppa.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Debian PPA
 
 on:
@@ -40,7 +41,7 @@ jobs:
 
       - name: Checkout bunsenite
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
 
       - name: Get inputs
         if: steps.check-secret.outputs.skip != 'true'
diff --git a/.github/workflows/publish-flatpak.yml b/.github/workflows/publish-flatpak.yml
index f91d48b..062897c 100644
--- a/.github/workflows/publish-flatpak.yml
+++ b/.github/workflows/publish-flatpak.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Flatpak
 
 on:
@@ -39,7 +40,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-homebrew.yml b/.github/workflows/publish-homebrew.yml
index 93e6138..b1fed97 100644
--- a/.github/workflows/publish-homebrew.yml
+++ b/.github/workflows/publish-homebrew.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Homebrew
 
 on:
@@ -50,7 +51,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-macports.yml b/.github/workflows/publish-macports.yml
index 809e19c..e43f47d 100644
--- a/.github/workflows/publish-macports.yml
+++ b/.github/workflows/publish-macports.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish MacPorts
 
 on:
@@ -38,7 +39,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-nixpkgs.yml b/.github/workflows/publish-nixpkgs.yml
index 5458a4a..6f4b3ac 100644
--- a/.github/workflows/publish-nixpkgs.yml
+++ b/.github/workflows/publish-nixpkgs.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Nixpkgs
 
 on:
@@ -38,7 +39,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-obs.yml b/.github/workflows/publish-obs.yml
index ecf8130..1985a24 100644
--- a/.github/workflows/publish-obs.yml
+++ b/.github/workflows/publish-obs.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish OBS (openSUSE)
 
 on:
@@ -40,7 +41,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-packages.yml b/.github/workflows/publish-packages.yml
index 7d91015..8d33631 100644
--- a/.github/workflows/publish-packages.yml
+++ b/.github/workflows/publish-packages.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Packages
 
 on:
@@ -76,7 +77,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Homebrew publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-homebrew
@@ -97,7 +98,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Scoop publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-scoop
@@ -115,7 +116,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger AUR publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-aur
@@ -134,7 +135,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger WinGet publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-winget
@@ -152,7 +153,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Chocolatey publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-chocolatey
@@ -170,7 +171,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Flatpak publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-flatpak
@@ -187,7 +188,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger MacPorts publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-macports
@@ -204,7 +205,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Debian PPA publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-debian-ppa
@@ -221,7 +222,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger COPR publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-copr
@@ -238,7 +239,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger OBS publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-obs
@@ -255,7 +256,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Trigger Nixpkgs publisher
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@v3.0.0
         with:
           token: ${{ secrets.TAP_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           event-type: publish-nixpkgs
diff --git a/.github/workflows/publish-scoop.yml b/.github/workflows/publish-scoop.yml
index 6e44f4d..a3f8963 100644
--- a/.github/workflows/publish-scoop.yml
+++ b/.github/workflows/publish-scoop.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish Scoop
 
 on:
@@ -41,7 +42,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-winget.yml b/.github/workflows/publish-winget.yml
index 5690f65..5359a6d 100644
--- a/.github/workflows/publish-winget.yml
+++ b/.github/workflows/publish-winget.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Publish WinGet
 
 on:
@@ -45,7 +46,7 @@ jobs:
 
       - name: Checkout homebrew-tap
         if: steps.check-secret.outputs.skip != 'true'
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+        uses: actions/checkout@v6.0.1
         with:
           repository: ${{ env.TAP_REPO }}
           token: ${{ secrets.TAP_GITHUB_TOKEN }}
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index b89ced9..4f733f4 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
@@ -16,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
+        uses: dawidd6/action-send-mail@v3.12.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index deb4c80..026c051 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Release
 
 on:
@@ -58,10 +59,10 @@ jobs:
             archive: zip
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        uses: dtolnay/rust-toolchain@v1
         with:
           targets: ${{ matrix.target }}
 
@@ -70,7 +71,7 @@ jobs:
         run: cargo install cross --git https://github.com/cross-rs/cross
 
       - name: Install Zig
-        uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
+        uses: goto-bus-stop/setup-zig@v2.2.1
         with:
           version: 0.11.0
 
@@ -124,7 +125,7 @@ jobs:
           Compress-Archive -Path dist/* -DestinationPath bunsenite-${{ github.ref_name }}-${{ matrix.target }}.${{ matrix.archive }}
 
       - name: Upload artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: bunsenite-${{ matrix.target }}
           path: bunsenite-*.${{ matrix.archive }}
@@ -140,10 +141,10 @@ jobs:
       attestations: write
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Download all artifacts
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
+        uses: actions/download-artifact@v4.1.8
         with:
           path: artifacts
 
@@ -157,7 +158,7 @@ jobs:
           cat ../SHA256SUMS.txt
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
+        uses: softprops/action-gh-release@v2.2.1
         with:
           files: |
             artifacts/**/*
@@ -195,7 +196,7 @@ jobs:
             RSR Compliance: Bronze Tier | TPCF Perimeter: 3
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        uses: actions/attest-build-provenance@v2.4.0
         with:
           subject-path: |
             artifacts/**/*
@@ -211,16 +212,16 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Package crate
         run: cargo package
 
       - name: Attest crate provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
+        uses: actions/attest-build-provenance@v2.4.0
         with:
           subject-path: 'target/package/*.crate'
 
@@ -238,10 +239,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
+        uses: actions/setup-node@v4.0.2
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index d164336..62c15d1 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Rust CI — thin wrapper calling the shared estate reusable in
 # hyperpolymath/standards. Configure once, propagate everywhere.
 # See: docs/CI-REUSABLE-WORKFLOWS.adoc in standards.
@@ -11,11 +12,12 @@ on:
   pull_request:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@412a7031577112b31ee287cc6060179d638d6500
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     with:
       enable_audit: true
       enable_coverage: true
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 1871ab9..dc2bb26 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: OSSF Scorecard
 
 on:
@@ -8,11 +9,12 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 8f5b215..3b1c5df 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Secret Scanner
 
 on:
@@ -12,11 +13,12 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
     secrets: inherit
diff --git a/.github/workflows/stress-test.yml b/.github/workflows/stress-test.yml
index a6e6b25..c0ddece 100644
--- a/.github/workflows/stress-test.yml
+++ b/.github/workflows/stress-test.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Stress Testing
 on:
   schedule:
@@ -12,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Install stress testing tools
         run: |
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 8975bb9..0fd7bd6 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Prevention workflow - validates all workflows have proper security config
 name: Workflow Security Linter
 
@@ -18,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: actions/checkout@v4.1.1
 
       - name: Check SPDX headers
         run: |
diff --git a/.github/workflows/zig-ffi.yml b/.github/workflows/zig-ffi.yml
index dcf102c..0d129cd 100644
--- a/.github/workflows/zig-ffi.yml
+++ b/.github/workflows/zig-ffi.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: Zig FFI Build
 
 on:
@@ -41,20 +42,20 @@ jobs:
             lib_ext: dll
 
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        uses: dtolnay/rust-toolchain@v1
         with:
           components: rustfmt, clippy
 
       - name: Install Zig
-        uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
+        uses: goto-bus-stop/setup-zig@v2.2.1
         with:
           version: 0.11.0
 
       - name: Cache Cargo
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@v4.3.0
         with:
           path: |
             ~/.cargo/registry
@@ -76,7 +77,7 @@ jobs:
           nm -D zig/zig-out/lib/libbunsenite.so | grep -E "parse_nickel|validate_nickel|free_string|version|rsr_tier|tpcf_perimeter" || true
 
       - name: Upload FFI library
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: libbunsenite-${{ matrix.os }}
           path: |
@@ -91,13 +92,13 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Install Zig
-        uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
+        uses: goto-bus-stop/setup-zig@v2.2.1
         with:
           version: 0.11.0
 
@@ -119,18 +120,18 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@v6.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # master
+        uses: dtolnay/rust-toolchain@v1
 
       - name: Install Zig
-        uses: goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406 # v2.2.1
+        uses: goto-bus-stop/setup-zig@v2.2.1
         with:
           version: 0.11.0
 
       - name: Install Deno
-        uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1.5.2
+        uses: denoland/setup-deno@v1.5.2
         with:
           deno-version: v1.x