diff --git a/.github/workflows/claim-sweep.yml b/.github/workflows/claim-sweep.yml
index b61402d..5d42e5b 100644
--- a/.github/workflows/claim-sweep.yml
+++ b/.github/workflows/claim-sweep.yml
@@ -69,7 +69,7 @@ concurrency:
 jobs:
   sweep:
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@d126d721fa50275e12af0bdeaf1a2ff3016eedfd
+    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index f74b3f9..bc0ea06 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -127,7 +127,7 @@ jobs:
   deploy:
     needs: build
     if: needs.build.outputs.oci != ''
-    uses: bounded-systems/.github/.github/workflows/site-deploy.yml@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # .github main (deferred_sign, site#243 — over #251's Face ID promote gate)
+    uses: bounded-systems/.github/.github/workflows/site-deploy.yml@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445 # .github main (deferred_sign, site#243 — over #251's Face ID promote gate)
     with:
       oci: ${{ needs.build.outputs.oci }}
       domain: "https://bounded.tools"
diff --git a/.github/workflows/front-desk-add.yml b/.github/workflows/front-desk-add.yml
index 14ca694..b9a8f22 100644
--- a/.github/workflows/front-desk-add.yml
+++ b/.github/workflows/front-desk-add.yml
@@ -59,7 +59,7 @@ jobs:
         id: app-token
         if: ${{ vars.CF_BROKER_URL != '' }}
         continue-on-error: true
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@d126d721fa50275e12af0bdeaf1a2ff3016eedfd # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445 # broker-gh-token (prx-26bq), .github#109
         with:
           app: front-desk
           broker-url: ${{ vars.CF_BROKER_URL }}
diff --git a/.github/workflows/pr-claim.yml b/.github/workflows/pr-claim.yml
index 871c69f..9aa9df1 100644
--- a/.github/workflows/pr-claim.yml
+++ b/.github/workflows/pr-claim.yml
@@ -81,4 +81,4 @@ jobs:
       issues: read
       pull-requests: read
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@bc4cb7dada47cc59eed416372a4851201bd6f503
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@2cd9ebc0a2543b3ba11dc7673b351a9d1f6c9445