diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index bcff78a..5376676 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -2,8 +2,15 @@
 # Do not edit by hand; run `gh actions-lock` to update.
 # Docs: https://gh.io/actions-lockfile
 #
-# Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause)
-# and onboard all 36 workflows. Verified with scripts/check-lock-sync.sh locally.
+# Regenerated 2026-10-15 to close every dangling edge (the startup_failure cause).
+# An action pinned by SHA at a release records the release tag as `ref`, as
+# gh actions-lock writes it; untagged workflow pins keep the SHA. Since
+# 2026-10-16 job setup refuses a tagged action whose record repeats the SHA
+# as `ref` ("invalid lockfile pin"): in this lock, and, for the actions a
+# reusable workflow uses, in the called repository's lock at the pinned
+# commit. Both standards workflows are therefore pinned at 75bd5994, whose
+# lock records tags; at 94572e6 it did not. Reusable-workflow records list
+# the actions the workflow uses (`uses:`).
 version: 'v0.0.3'
 workflows:
     '.github/workflows/codeql.yml':
@@ -19,17 +26,22 @@ workflows:
     '.github/workflows/push-email-notify.yml':
         - 'hyperpolymath/smtp-notify-action@v0.2.0'
     '.github/workflows/scorecard.yml':
-        - 'hyperpolymath/standards@main'
+        - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
     '.github/workflows/secret-scanner.yml':
-        - 'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3'
+        - 'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66'
 dependencies:
     'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
-        ref: '3d3c42e5aac5ba805825da76410c181273ba90b1'
+        ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
         owner_id: 44036562
         repo_id: 197814629
+    'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
     'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63':
-        ref: 'b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+        ref: 'v4.38.0'
         commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
         owner_id: 9919
         repo_id: 259445878
@@ -43,13 +55,18 @@ dependencies:
         commit: 'sha1-ede1191ef6ff3ac02c4f4d9efdf837ee517e11d7'
         owner_id: 6759885
         repo_id: 1352485172
-    'hyperpolymath/standards@94572e612a7bf11f8e6343d19adadf17ef2a3de3':
-        ref: '94572e612a7bf11f8e6343d19adadf17ef2a3de3'
-        commit: 'sha1-94572e612a7bf11f8e6343d19adadf17ef2a3de3'
-        owner_id: 6759885
-        repo_id: 1116521501
-    'hyperpolymath/standards@main':
-        ref: 'main'
-        commit: 'sha1-68242e650c0bd83bbf280f3b578fa949c0ab4c16'
+    'hyperpolymath/standards@75bd5994470661a099df562d6d5ad2fe744dbd66':
+        ref: '75bd5994470661a099df562d6d5ad2fe744dbd66'
+        commit: 'sha1-75bd5994470661a099df562d6d5ad2fe744dbd66'
         owner_id: 6759885
         repo_id: 1116521501
+        uses:
+            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
+            - 'actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+            - 'github/codeql-action@b96794f015dfd88f77b49b1c93e0fa7110f94c63'
+            - 'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc'
+    'ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc':
+        ref: 'v2.4.4'
+        commit: 'sha1-2d1146689b8cda280b9bc96326124645441f03bc'
+        owner_id: 67707773
+        repo_id: 421101922
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 81aa2e4..07f8fa0 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -26,7 +26,9 @@ permissions:
 jobs:
   scorecard:
     name: OSSF Scorecard Check
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@main
+    # Pinned by SHA at a standards commit whose own lock records release
+    # tags as refs; see the actions.lock header.
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index ede150a..6254c61 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -2,8 +2,9 @@
 # Calls the estate's shared secret scanner (gitleaks + rust-secrets +
 # shell-secrets).
 #
-# `secrets: inherit` is REQUIRED: without it the gitleaks action's inner
-# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
+# No `secrets:` line: the reusable workflow declares no secrets and reads
+# none, and `secrets: inherit` would forward every secret this repository
+# can see (CWE-250; standards#1108 §6b, in the workflow's own header).
 name: "Secret Scanner"
 on:
   push:
@@ -20,5 +21,5 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@94572e612a7bf11f8e6343d19adadf17ef2a3de3
-    secrets: inherit
+    # The same standards commit as scorecard.yml; see the actions.lock header.
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66