diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 8d34818..48d333b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -20,7 +20,10 @@ jobs:
     # Reusable called-workflow permissions are CAPPED by the caller's grants;
     # without security-events: write here the scorecard SARIF upload fails with
     # startup_failure (hypatia WF018). id-token: write enables OIDC publish.
+    # actions: read must be repeated here: a job-level block replaces the
+    # workflow-level one, and the callee's job asks for actions: read.
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 0e7af9d..9b6c366 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -2,8 +2,10 @@
 # Calls the estate's shared secret scanner (gitleaks + rust-secrets +
 # shell-secrets).
 #
-# `secrets: inherit` is REQUIRED: without it the gitleaks action's inner
-# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
+# No `secrets:` line: the reusable workflow (standards@75bd5994) declares no
+# secrets and reads none. Its gitleaks is a pinned local binary, and the
+# GITHUB_TOKEN its jobs run under is governed by `permissions:`, not by secret
+# passing. `secrets: inherit` would forward every repository secret for nothing.
 name: "Secret Scanner"
 on:
   push:
@@ -21,4 +23,3 @@ permissions:
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
-    secrets: inherit