diff --git a/.github/workflows/ci-health-sweep.yml b/.github/workflows/ci-health-sweep.yml
index c26d8ecc..3d705b66 100644
--- a/.github/workflows/ci-health-sweep.yml
+++ b/.github/workflows/ci-health-sweep.yml
@@ -45,6 +45,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - uses: actions/checkout@v7.0.1
       - name: Run CI-health sweep
         env:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 86842d10..d1875204 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -62,6 +62,14 @@ jobs:
       pull-requests: write   # needed to approve
 
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - name: Fetch Dependabot metadata
         id: meta
         uses: dependabot/fetch-metadata@v3.1.0
diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml
index 3e747485..027b3871 100644
--- a/.github/workflows/label-triage.yml
+++ b/.github/workflows/label-triage.yml
@@ -49,6 +49,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - name: Classify and label
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index a4208d7f..e751fdec 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -35,6 +35,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - name: Apply canonical labels
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/roadmap-sync.yml b/.github/workflows/roadmap-sync.yml
index eae7a233..ea784ee8 100644
--- a/.github/workflows/roadmap-sync.yml
+++ b/.github/workflows/roadmap-sync.yml
@@ -46,6 +46,14 @@ jobs:
       EXCLUDE: 'idaptik burble rattlescript vcl-ut'
       WINDOW_MIN: ${{ inputs.window_min || '45' }}   # look-back window (> cron interval for overlap)
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - name: Mint App installation token
         id: app
         uses: actions/create-github-app-token@v3.3.0