diff --git a/.github/workflows/claim-sweep.yml b/.github/workflows/claim-sweep.yml
index 318a448..ec24083 100644
--- a/.github/workflows/claim-sweep.yml
+++ b/.github/workflows/claim-sweep.yml
@@ -69,7 +69,7 @@ concurrency:
 jobs:
   sweep:
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@14c1a9b3ade8bb6416f46c890eda21823647da09
+    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@c95ed4e5715faf591d63ed44c926ea71fa2e1033
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index b34ad0a..69eecb0 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -43,4 +43,4 @@ jobs:
   osv:
     # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a
     # reviewer can tell an intentional bump from a drifted one.
-    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@30978ba6776c30081379e23fa20a12f36db3a48c # main
+    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@fb7ca62fd9fb8af90af1097a0b21ee703c103dc4 # main
diff --git a/.github/workflows/front-desk-add.yml b/.github/workflows/front-desk-add.yml
index 4934806..7f67a94 100644
--- a/.github/workflows/front-desk-add.yml
+++ b/.github/workflows/front-desk-add.yml
@@ -59,7 +59,7 @@ jobs:
         id: app-token
         if: ${{ vars.CF_BROKER_URL != '' }}
         continue-on-error: true
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@99e88a0335519cb78be8a1b6623105613fa6aca1 # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@c95ed4e5715faf591d63ed44c926ea71fa2e1033 # broker-gh-token (prx-26bq), .github#109
         with:
           app: front-desk
           broker-url: ${{ vars.CF_BROKER_URL }}
diff --git a/.github/workflows/pr-claim.yml b/.github/workflows/pr-claim.yml
index 65c6008..cafa337 100644
--- a/.github/workflows/pr-claim.yml
+++ b/.github/workflows/pr-claim.yml
@@ -53,4 +53,4 @@ jobs:
       issues: read
       pull-requests: read
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@8a56f22f32bd007affbef503a4f1ac736c9aa52d
\ No newline at end of file
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@c95ed4e5715faf591d63ed44c926ea71fa2e1033
\ No newline at end of file
diff --git a/.github/workflows/standard.yml b/.github/workflows/standard.yml
index 7836a0d..2290748 100644
--- a/.github/workflows/standard.yml
+++ b/.github/workflows/standard.yml
@@ -9,7 +9,7 @@ permissions:
   contents: read
 jobs:
   standard:
-    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@99e88a0335519cb78be8a1b6623105613fa6aca1
+    uses: bounded-systems/.github/.github/workflows/repo-standard.yml@c95ed4e5715faf591d63ed44c926ea71fa2e1033
     with:
       security: true
       test: true