diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 1650ae5..0239fdd 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -10,6 +10,7 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 concurrency:
@@ -18,4 +19,4 @@ concurrency:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 829ae18..30d86dd 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -12,9 +12,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
   security-events: write
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 1f60f1c..6fabfb1 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -6,8 +6,9 @@ on:
     branches: [main]
   workflow_dispatch:
 permissions:
+  actions: read
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0c4aed8..d53591c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,7 +20,8 @@ jobs:
     # caller's top-level contents: read; a reusable requesting more
     # permissions than its caller grants is a startup_failure.
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 2be1ae9..b178b77 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -12,5 +12,5 @@ permissions:
   contents: read
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@5a597720580d12fa04d24e1b9e100e2eb8d6e653
     secrets: inherit