diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index fc6e0913..5778a7f0 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -92,6 +92,7 @@ workflows:
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
         - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
     '.github/workflows/scorecard-reusable.yml':
+        - 'github/codeql-action@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28'
         - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
         - 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a'
         - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml
index 4e32fade..88f23737 100644
--- a/.github/workflows/scorecard-reusable.yml
+++ b/.github/workflows/scorecard-reusable.yml
@@ -29,13 +29,28 @@ jobs:
       - name: Run Scorecard Analysis
         uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
-          results_file: results.json
-          results_format: json
+          results_file: results.sarif
+          results_format: sarif
+          # publish_results feeds the public OpenSSF API and the badge, and is
+          # INDEPENDENT of results_format -- so emitting SARIF does not cost us
+          # the badge. Both outputs are live with this shape.
           publish_results: true
 
+      # RESTORED 2026-08-25. Commit 5a93d9d5 (PR #393, "Ci/gitleaks self hosted
+      # fix", 2026-06-21) deleted this step and switched results_format to json
+      # as collateral of an unrelated gitleaks refactor. Without a SARIF upload
+      # nothing feeds GitHub code scanning, so every Scorecard alert in the
+      # estate froze: measured in this repo on 2026-08-25, all 12 Scorecard
+      # alerts were stuck at 2026-06-03 while Hypatia's updated 2026-08-24.
+      # The badge kept working, which is why it went unnoticed.
+      - name: Upload SARIF to code scanning
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v3
+        with:
+          sarif_file: results.sarif
+
       - name: Upload results artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: scorecard-results
-          path: results.json
+          path: results.sarif
           retention-days: 90