diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index ce95a606..611eccd0 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -68,7 +68,7 @@ workflows:
         - 'swatinem/rust-cache@v2.9.2'
     '.github/workflows/rust-ci.yml':
         - 'actions/checkout@v7.0.1'
-        - 'dtolnay/rust-toolchain@master'
+        - 'dtolnay/rust-toolchain@v1'
         - 'swatinem/rust-cache@v2.9.2'
     '.github/workflows/s4-loop.yml':
         - 'actions/checkout@v7.0.1'
@@ -94,7 +94,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/zig-ffi-ci.yml':
         - 'actions/checkout@v7.0.1'
-        - 'hyperpolymath/cicd-suite@main'
+        - 'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f'
         - 'mlugg/setup-zig@v2.2.1'
 dependencies:
     'actions/attest-build-provenance@v4.2.2':
@@ -146,14 +146,9 @@ dependencies:
         repo_id: 496012378
         uses:
             - 'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
-    'dtolnay/rust-toolchain@master':
-        ref: 'master'
-        commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
-        owner_id: 1940490
-        repo_id: 260749683
     'dtolnay/rust-toolchain@v1':
         ref: 'v1'
-        commit: 'sha1-02cb101ec7c40f2c49e1d9714d64511d8e1b74de'
+        commit: 'sha1-7e38f4b43b4db5c8dd498af069a4f6196df1d067'
         owner_id: 1940490
         repo_id: 260749683
     'erlef/setup-beam@v1.24.1':
@@ -176,9 +171,9 @@ dependencies:
         commit: 'sha1-0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d'
         owner_id: 75048950
         repo_id: 623796603
-    'hyperpolymath/cicd-suite@main':
+    'hyperpolymath/cicd-suite@4c772eb235b04455307d5c03cbbc4f45130f7f0f':
         ref: 'main'
-        commit: 'sha1-d9ebcf99ad4593611b4fa0e18f09b03801f200e8'
+        commit: 'sha1-4c772eb235b04455307d5c03cbbc4f45130f7f0f'
         owner_id: 6759885
         repo_id: 1326697643
     'mlugg/setup-zig@v2.2.1':
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index acdafcc8..3d9b71f1 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -78,12 +78,13 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: Install Rust toolchain
-        # `toolchain:` is mandatory because the action is pinned by commit SHA:
+        # `toolchain:` is mandatory because the ref is `@v1` (pinned to a commit
+        # through actions.lock), not a toolchain name:
         # dtolnay/rust-toolchain infers the toolchain from the `@`-ref (e.g.
         # `@stable`), but a SHA ref carries no version, so the action's "parse
         # toolchain version" step fails with `'toolchain' is a required input`.
         # See standards estate-wide rust-ci red.
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
           components: clippy, rustfmt
@@ -132,7 +133,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
 
@@ -183,7 +184,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
 
@@ -219,7 +220,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
           components: llvm-tools-preview
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 075b227d..d30a4a1c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -22,6 +22,7 @@ jobs:
     # contents: read must be restated here — the reusable declares it
     # (checkout needs it) and startup-fails if the caller doesn't grant it.
     permissions:
+      actions: read
       security-events: write
       id-token: write
       contents: read
diff --git a/.github/workflows/static-analysis-gate.yml b/.github/workflows/static-analysis-gate.yml
index 30e75ac7..6f335965 100644
--- a/.github/workflows/static-analysis-gate.yml
+++ b/.github/workflows/static-analysis-gate.yml
@@ -166,8 +166,16 @@ jobs:
       - name: Clone and build Hypatia
         id: build
         continue-on-error: true
+        env:
+          # Pinned to the hypatia commit standards@5751b97e vets as its default.
+          # When the standards callers move to that ref, the governance baseline
+          # job and this gate build the same scanner; move them together.
+          HYPATIA_REF: 51ab6496bf47e30a0576d503df31fec30f3cfe56
         run: |
-          git clone https://github.com/hyperpolymath/hypatia.git "$HOME/hypatia" 2>/dev/null || true
+          git init -q "$HOME/hypatia" \
+            && git -C "$HOME/hypatia" fetch -q --depth 1 https://github.com/hyperpolymath/hypatia.git "$HYPATIA_REF" \
+            && git -C "$HOME/hypatia" checkout -q FETCH_HEAD \
+            || true
           if [ -f "$HOME/hypatia/mix.exs" ]; then
             cd "$HOME/hypatia"
             # Build escript if neither hypatia nor hypatia-v2 exists
diff --git a/.github/workflows/zig-ffi-ci.yml b/.github/workflows/zig-ffi-ci.yml
index 2d783fb9..e2f41955 100644
--- a/.github/workflows/zig-ffi-ci.yml
+++ b/.github/workflows/zig-ffi-ci.yml
@@ -59,4 +59,4 @@ jobs:
           persist-credentials: false
 
       - name: Zig unified-api-adapter check (hyperpolymath/cicd-suite)
-        uses: hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check@main
+        uses: hyperpolymath/cicd-suite/actions/zig-unified-api-adapter-check@4c772eb235b04455307d5c03cbbc4f45130f7f0f # main 2026-10-02