diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index d1565ea..cde421d 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -3,6 +3,8 @@
 # Docs: https://gh.io/actions-lockfile
 version: 'v0.0.2'
 workflows:
+    '.github/workflows/governance.yml': []
+    '.github/workflows/secret-scanner.yml': []
     '.github/workflows/casket-pages.yml':
         - 'actions/cache@v4.3.0'
         - 'actions/checkout@v4.1.1'
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 6054ec9..0a52af3 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 72b7740..bde8b32 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 16a86a8..087ba04 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # governance.yml — single wrapper calling the shared estate governance bundle
 # in hyperpolymath/standards instead of carrying per-repo copies.
 #
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index fe580d6..43f66b4 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Hypatia Neurosymbolic CI/CD Security Scan
 name: Hypatia Security Scan
 
diff --git a/.github/workflows/lean-build.yml b/.github/workflows/lean-build.yml
index 20c2637..c90959c 100644
--- a/.github/workflows/lean-build.yml
+++ b/.github/workflows/lean-build.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Lean 4 Build and Test Workflow
 name: Lean 4 Build
 
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index b69c87f..4f733f4 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Dormant push-email notification. ARMED by setting the repo variable
 # PUSH_EMAIL_ENABLED=true (the single on/off switch). Addresses are pre-filled;
 # sending needs the org SMTP secrets (SMTP_HOST/PORT/USER/PASS). Inherited by
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 30b4dbd..d766450 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 name: OSSF Scorecard
 on:
   schedule:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 1ba0bdb..59441b9 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,5 +1,6 @@
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# This workflow is managed by gh actions-lock.
 # Calls the estate's shared secret scanner (gitleaks + rust-secrets +
 # shell-secrets). Added because this repository had NO leak scanning at all.
 #
@@ -14,6 +15,7 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 permissions:
+  actions: read
   contents: read
 jobs:
   secret-scan: