diff --git a/.github/workflows/ci-health-sweep.yml b/.github/workflows/ci-health-sweep.yml
index 3d705b66..c26d8ecc 100644
--- a/.github/workflows/ci-health-sweep.yml
+++ b/.github/workflows/ci-health-sweep.yml
@@ -45,14 +45,6 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      # Egress allowlist (RE001): this job talks only to the GitHub API.
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.2
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
       - uses: actions/checkout@v7.0.1
       - name: Run CI-health sweep
         env:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index d1875204..86842d10 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -62,14 +62,6 @@ jobs:
       pull-requests: write   # needed to approve
 
     steps:
-      # Egress allowlist (RE001): this job talks only to the GitHub API.
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.2
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
       - name: Fetch Dependabot metadata
         id: meta
         uses: dependabot/fetch-metadata@v3.1.0
diff --git a/.github/workflows/roadmap-sync.yml b/.github/workflows/roadmap-sync.yml
index ea784ee8..eae7a233 100644
--- a/.github/workflows/roadmap-sync.yml
+++ b/.github/workflows/roadmap-sync.yml
@@ -46,14 +46,6 @@ jobs:
       EXCLUDE: 'idaptik burble rattlescript vcl-ut'
       WINDOW_MIN: ${{ inputs.window_min || '45' }}   # look-back window (> cron interval for overlap)
     steps:
-      # Egress allowlist (RE001): this job talks only to the GitHub API.
-      - name: Harden runner
-        uses: step-security/harden-runner@v2.22.2
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
       - name: Mint App installation token
         id: app
         uses: actions/create-github-app-token@v3.3.0