diff --git a/.github/workflows/affinescript-verify.yml b/.github/workflows/affinescript-verify.yml
index e2b02960..af44cedc 100644
--- a/.github/workflows/affinescript-verify.yml
+++ b/.github/workflows/affinescript-verify.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: AffineScript Verify
 # Direct pushes only on integration branches. Feature-branch validation
 # is fully covered by pull_request — running a full AffineScript verify
diff --git a/.github/workflows/boj-build.yml b/.github/workflows/boj-build.yml
index d024b5e4..ab800d98 100644
--- a/.github/workflows/boj-build.yml
+++ b/.github/workflows/boj-build.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 #
 # OPTIONAL: BoJ Server Build Trigger
 # This workflow notifies a BoJ Server instance when code is pushed.
diff --git a/.github/workflows/casket-pages.yml b/.github/workflows/casket-pages.yml
index 86725077..3b1b242f 100644
--- a/.github/workflows/casket-pages.yml
+++ b/.github/workflows/casket-pages.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages
 
 on:
diff --git a/.github/workflows/changelog-reusable.yml b/.github/workflows/changelog-reusable.yml
index 047dc8ed..d66a4205 100644
--- a/.github/workflows/changelog-reusable.yml
+++ b/.github/workflows/changelog-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # SPDX-FileCopyrightText: 2026 Jonathan D.A. Jewell (hyperpolymath)
 #
 # changelog-reusable.yml — Generate CHANGELOG.md from conventional commits.
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 7d2a6bf5..3b3fb0b9 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Changelog
 
 on:
diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml
index c1a12fa8..acda07d7 100644
--- a/.github/workflows/codeql-reusable.yml
+++ b/.github/workflows/codeql-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # codeql-reusable.yml — Reusable CodeQL security-analysis workflow.
 #
 # Consolidates the per-repo `codeql.yml` workflow (estate-wide: 263
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 23630107..70b24201 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: CodeQL Security Analysis
 
 on:
diff --git a/.github/workflows/deno-ci-reusable.yml b/.github/workflows/deno-ci-reusable.yml
index 1af572ef..0d818181 100644
--- a/.github/workflows/deno-ci-reusable.yml
+++ b/.github/workflows/deno-ci-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # deno-ci-reusable.yml — Reusable Deno CI bundle (RSR).
 #
 # Replaces the per-repo `rescript-deno-ci.yml` template that copy-drifted
diff --git a/.github/workflows/deno-ci.yml b/.github/workflows/deno-ci.yml
index bdfcaebd..6476197c 100644
--- a/.github/workflows/deno-ci.yml
+++ b/.github/workflows/deno-ci.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Deno CI
 
 on:
diff --git a/.github/workflows/doc-format.yml b/.github/workflows/doc-format.yml
index f85e7a06..986a373e 100644
--- a/.github/workflows/doc-format.yml
+++ b/.github/workflows/doc-format.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Documentation Format Enforcement
 
 on:
diff --git a/.github/workflows/dyadt-verify.yml b/.github/workflows/dyadt-verify.yml
index 9b7493ea..2a37a498 100644
--- a/.github/workflows/dyadt-verify.yml
+++ b/.github/workflows/dyadt-verify.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # dyadt-verify — DYADT dogfood. Verify this repo's CLAIMS.a2ml against primary
 # evidence, and run the DYADT conformance vector suite. If a claim this change
 # makes is false, the verifier REFUTES it and this job fails loudly.
diff --git a/.github/workflows/echidna-verify.yml b/.github/workflows/echidna-verify.yml
index eb6c6878..edca172f 100644
--- a/.github/workflows/echidna-verify.yml
+++ b/.github/workflows/echidna-verify.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # ECHIDNA proof verification — formal verification of Agda and Idris2 proofs.
 #
 # Scope:
diff --git a/.github/workflows/elixir-ci-reusable.yml b/.github/workflows/elixir-ci-reusable.yml
index 037dd2c4..519ce4ab 100644
--- a/.github/workflows/elixir-ci-reusable.yml
+++ b/.github/workflows/elixir-ci-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # elixir-ci-reusable.yml — Reusable Elixir CI bundle (RSR).
 #
 # Replaces the per-repo `elixir-ci.yml` template that copy-drifted (and
diff --git a/.github/workflows/elixir-ci.yml b/.github/workflows/elixir-ci.yml
index 36f86a0d..3d5d9a92 100644
--- a/.github/workflows/elixir-ci.yml
+++ b/.github/workflows/elixir-ci.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Elixir CI
 
 on:
diff --git a/.github/workflows/governance-reusable.yml b/.github/workflows/governance-reusable.yml
index 9a405e76..96038505 100644
--- a/.github/workflows/governance-reusable.yml
+++ b/.github/workflows/governance-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Governance checks for hyperpolymath repositories — Reusable Workflow
 name: Governance Reusable Workflow
 
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 910ff38f..d1f0d8a3 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Governance
 
 on:
diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml
index 6a617c75..fa5386e1 100644
--- a/.github/workflows/hypatia-scan-reusable.yml
+++ b/.github/workflows/hypatia-scan-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Hypatia Neurosymbolic CI/CD Security Scan — Reusable Workflow
 name: Hypatia Reusable Scan
 
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 9627bfa6..171a1c28 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Hypatia Security Scan
 
 on:
diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index 98317961..16343c8b 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Instant Forge Sync - Triggers propagation to all forges on push/release
 name: Instant Sync
 
diff --git a/.github/workflows/launcher-standard-lockstep.yml b/.github/workflows/launcher-standard-lockstep.yml
index 964b944d..58b05819 100644
--- a/.github/workflows/launcher-standard-lockstep.yml
+++ b/.github/workflows/launcher-standard-lockstep.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: launcher-standard lock-step
 
 # Enforces the sync requirement declared in launcher/README.adoc §Sync
diff --git a/.github/workflows/makefile-blocker.yml b/.github/workflows/makefile-blocker.yml
index 0fa50704..37d9cfbc 100644
--- a/.github/workflows/makefile-blocker.yml
+++ b/.github/workflows/makefile-blocker.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Makefile Blocker
 
 on:
diff --git a/.github/workflows/mirror-reusable.yml b/.github/workflows/mirror-reusable.yml
index 01ff2dcf..6f894538 100644
--- a/.github/workflows/mirror-reusable.yml
+++ b/.github/workflows/mirror-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # mirror-reusable.yml — Reusable git-forge mirror bundle.
 #
 # Consolidates the per-repo `mirror.yml` workflow (estate-wide: 289
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 08901e08..470b7649 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Mirror to Git Forges
 
 on:
diff --git a/.github/workflows/no-js-scan.yml b/.github/workflows/no-js-scan.yml
index 29dbefb2..3f6e9db0 100644
--- a/.github/workflows/no-js-scan.yml
+++ b/.github/workflows/no-js-scan.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: No-JS Scan (warn-first)
 
 # Estate policy: no hand-authored JavaScript/TypeScript source
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 422373ca..a1f8b2e5 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: GitHub Pages (Ddraig SSG)
 on:
   push:
diff --git a/.github/workflows/readme-derive-reusable.yml b/.github/workflows/readme-derive-reusable.yml
index 6237a982..59c78c5d 100644
--- a/.github/workflows/readme-derive-reusable.yml
+++ b/.github/workflows/readme-derive-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # README single-source derivation — Reusable Workflow (ADR-004)
 #
 # Author READMEs once in AsciiDoc; derive README.md ONLY for repos that
diff --git a/.github/workflows/readme-derive.yml b/.github/workflows/readme-derive.yml
index 7d511c6f..b07c555e 100644
--- a/.github/workflows/readme-derive.yml
+++ b/.github/workflows/readme-derive.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: README Derive
 
 on:
diff --git a/.github/workflows/registry-verify.yml b/.github/workflows/registry-verify.yml
index 84ad6af0..6827777a 100644
--- a/.github/workflows/registry-verify.yml
+++ b/.github/workflows/registry-verify.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # registry-verify — fail the build if the spec registry or the DERIVED
 # topology map has drifted from the file tree. This is the in-repo half of
 # the drift-detection loop (the estate half is Hypatia rule HYP-S006).
diff --git a/.github/workflows/rust-ci-reusable.yml b/.github/workflows/rust-ci-reusable.yml
index 46375ca5..1daa6ed1 100644
--- a/.github/workflows/rust-ci-reusable.yml
+++ b/.github/workflows/rust-ci-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # rust-ci-reusable.yml — Reusable Rust CI bundle (RSR).
 #
 # Replaces the per-repo `rust-ci.yml` template that copy-drifted across
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 751e7e03..acf3bf45 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Rust CI
 
 on:
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
index 19e057a5..08899943 100644
--- a/.github/workflows/scorecard-enforcer.yml
+++ b/.github/workflows/scorecard-enforcer.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # Prevention workflow - runs OpenSSF Scorecard and fails on low scores
 name: OpenSSF Scorecard Enforcer
 
diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml
index 7422b4d3..d71898d3 100644
--- a/.github/workflows/scorecard-reusable.yml
+++ b/.github/workflows/scorecard-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: OSSF Scorecard Reusable Workflow
 
 on:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index dbffff92..59542efd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Scorecard
 
 on:
diff --git a/.github/workflows/secret-scanner-reusable.yml b/.github/workflows/secret-scanner-reusable.yml
index 45d0978f..6d0e1b7d 100644
--- a/.github/workflows/secret-scanner-reusable.yml
+++ b/.github/workflows/secret-scanner-reusable.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # secret-scanner-reusable.yml — Reusable secret-scanner bundle.
 #
 # Consolidates the per-repo `secret-scanner.yml` workflow (estate-wide:
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 3e7e3341..c5ba2cc2 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: Secret Scanner
 
 on:
diff --git a/.github/workflows/self-test.yml b/.github/workflows/self-test.yml
index 1d9ea580..255e66c2 100644
--- a/.github/workflows/self-test.yml
+++ b/.github/workflows/self-test.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # self-test — run this repo's own test suite.
 #
 # WHY: `tests/test_check_trusted_base.sh` has existed for some time and was
diff --git a/.github/workflows/signed-push-smoke.yml b/.github/workflows/signed-push-smoke.yml
index 83330b21..fb7cd3e2 100644
--- a/.github/workflows/signed-push-smoke.yml
+++ b/.github/workflows/signed-push-smoke.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 # End-to-end check for the signed-push composite action: pushes a throwaway commit
 # via the GitHub App and asserts GitHub marks it "Verified". Manual trigger only.
 # Requires repo/org secret APP_PRIVATE_KEY and variable APP_ID (the estate App).
diff --git a/.github/workflows/spark-theatre-gate.yml b/.github/workflows/spark-theatre-gate.yml
index 445b5379..88908f21 100644
--- a/.github/workflows/spark-theatre-gate.yml
+++ b/.github/workflows/spark-theatre-gate.yml
@@ -1,5 +1,5 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
+# This workflow is managed by gh actions-lock.
 name: SPARK Theatre Gate
 
 # Estate anti-theatre lint (hyperpolymath/standards#135, sub-issue of #124).
diff --git a/scripts/check-allowed-actions.sh b/scripts/check-allowed-actions.sh
index 4a0d9087..d6ef5e29 100755
--- a/scripts/check-allowed-actions.sh
+++ b/scripts/check-allowed-actions.sh
@@ -37,7 +37,8 @@ def owner_repo(u):
     return '/'.join(parts[:2]), parts[0]
 
 def covered(u):
-    if u.startswith('./') or u.startswith('docker://'):
+    # $/ is gh actions-lock's inherently-pinned same-repo form (like ./)
+    if u.startswith('./') or u.startswith('$/') or u.startswith('docker://'):
         return True
     orp, owner = owner_repo(u)
     if owner in gh_owned:                       # github-owned (actions/*, github/*)
diff --git a/scripts/relock-sha-keys.sh b/scripts/relock-sha-keys.sh
new file mode 100755
index 00000000..ddbb3c8c
--- /dev/null
+++ b/scripts/relock-sha-keys.sh
@@ -0,0 +1,66 @@
+#!/usr/bin/env bash
+# SPDX-License-Identifier: MPL-2.0
+#
+# Re-key gh-actions-lock's tag-form lockfile entries back to the inline SHA
+# refs used in the workflow files.
+#
+# gh actions-lock prettifies `uses: owner/repo@<sha> # vX` to `owner/repo@vX`
+# and keys .github/workflows/actions.lock by that tag. This estate keeps
+# inline SHA pins in workflow files (Mustfile actions-sha-pinned, governance
+# workflow linter, hypatia rule, and GitHub's sha_pinning_required all enforce
+# them), so after every `gh actions-lock` regeneration:
+#
+#   1. restore the SHA-pinned workflow files (git checkout -- ...)
+#   2. run this script to re-key the lockfile to match
+#
+# Entries are only re-keyed when the recorded commit digest matches a SHA
+# actually written inline in a workflow file (subpath-aware: the lockfile
+# keys `github/codeql-action` while workflows may pin
+# `github/codeql-action/init@<sha>`). Transitive deps inside external
+# composites keep the ref form their composite wrote. Key SHA == commit
+# digest, which the lockfile format already supports.
+#
+# Usage: scripts/relock-sha-keys.sh [workflows-dir]   (default .github/workflows)
+
+set -euo pipefail
+wf_dir="${1:-.github/workflows}"
+
+python3 - "$wf_dir" <<'PY'
+import re
+import sys
+from pathlib import Path
+
+wf_dir = Path(sys.argv[1])
+lock_path = wf_dir / "actions.lock"
+text = lock_path.read_text()
+
+# Inline SHA refs from workflow files: repo root (lowercase) -> set of SHAs.
+uses_re = re.compile(r"uses:\s*([A-Za-z0-9_.-]+/[A-Za-z0-9_./-]+)@([0-9a-f]{40})")
+inline = {}
+for f in sorted(wf_dir.glob("*.yml")) + sorted(wf_dir.glob("*.yaml")):
+    for m in uses_re.finditer(f.read_text()):
+        root = "/".join(m.group(1).split("/")[:2]).lower()
+        inline.setdefault(root, set()).add(m.group(2))
+
+# Lockfile dependency entries: key 'action@ref' with commit 'sha1-<sha>'.
+entry_re = re.compile(r"^    '([^'@]+)@([^']+)':\n((?:^ {8}.*\n?)*)", re.MULTILINE)
+mapping = {}
+for m in entry_re.finditer(text):
+    action, ref, body = m.group(1), m.group(2), m.group(3)
+    if re.fullmatch(r"[0-9a-f]{40}", ref):
+        continue  # already SHA-keyed
+    cm = re.search(r"commit:\s*'sha1-([0-9a-f]{40})'", body)
+    if not cm:
+        continue
+    sha = cm.group(1)
+    if sha in inline.get(action.lower(), set()):
+        mapping[f"{action}@{ref}"] = f"{action}@{sha}"
+
+for old, new in mapping.items():
+    text = text.replace(f"'{old}'", f"'{new}'")
+
+lock_path.write_text(text)
+print(f"re-keyed {len(mapping)} entries:")
+for old, new in sorted(mapping.items()):
+    print(f"  {old} -> @{new.rsplit('@', 1)[1][:12]}")
+PY