diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index a04c0675..416ab42c 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -18,11 +18,12 @@ jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
     # Scanner pin, overriding the reusable's default (51ab649, which rejects the
-    # v0.0.3 actions.lock that gh actions-lock now writes). aa34a4c carries
-    # #938. Same value as standards#1315; drop this input once the `uses:` above
-    # is re-pinned past that PR.
+    # v0.0.3 actions.lock that gh actions-lock now writes). This is hypatia main
+    # with #938 (v0.0.3 lock), #942 (WH013 per-job credentials) and #947
+    # (RE005 trap handlers). Drop this input once the standards callers are
+    # re-pinned to a default that includes them.
     with:
-      hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d
+      hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 4739c432..68477449 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -24,7 +24,7 @@ jobs:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
     # Scanner pin: see governance.yml. Drop once `uses:` is re-pinned.
     with:
-      hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d
+      hypatia-ref: 23dc74de05fb34fe0e6f8d204fb65bf0625673a0
     # Only the one secret the callee declares (standards#1108 §6b).
     secrets:
       HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}