diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index d9a1d6d..2c7c506 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   build:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 35
     steps:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d1c2220..35eaf1e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -11,6 +11,7 @@ permissions: read-all
 jobs:
   analysis:
     permissions:
+      contents: read
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
diff --git a/.github/workflows/tla-consensus.yml b/.github/workflows/tla-consensus.yml
index 4486881..2f3751f 100644
--- a/.github/workflows/tla-consensus.yml
+++ b/.github/workflows/tla-consensus.yml
@@ -36,7 +36,7 @@ jobs:
         run: |
           curl -fsSL -o tla2tools.jar \
             https://github.com/tlaplus/tlaplus/releases/download/v1.8.0/tla2tools.jar
-          echo "237332bdcc79a35c7d26efa7b82c77c85c2744591c5598673a8a45085ff2a4fb  tla2tools.jar" \
+          echo "cc4803dce2a8ffaf0f5920a9dc39df4b5ee34ab4cb53fb58ac557277a7e516b3  tla2tools.jar" \
             | sha256sum -c -
 
       - name: TLC positive — all safety invariants hold at Threshold = 2F+1