diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 927af6c..10a7d57 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,9 +18,9 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: nix-forge/ci/actions/setup-nix@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+      - uses: nix-forge/ci/actions/setup-nix@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
       - name: Validate workflows and template contracts
-        uses: nix-forge/ci/actions/validate-workflows@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+        uses: nix-forge/ci/actions/validate-workflows@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
   queue-completion:
     continue-on-error: true
     name: Queue completion callback
@@ -32,4 +32,4 @@ jobs:
       actions: write # Notify the trusted default-branch reconciler.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+        uses: nix-forge/ci/actions/queue-completion@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5f557f1..51e3ff0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,7 +23,7 @@ jobs:
       actions: read # Read workflow metadata for Actions analysis.
       contents: read
       security-events: write # Upload code scanning results.
-    uses: nix-forge/ci/.github/workflows/codeql.yml@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+    uses: nix-forge/ci/.github/workflows/codeql.yml@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
     with:
       languages: actions
   queue-completion:
@@ -37,4 +37,4 @@ jobs:
       actions: write # Dispatch trusted queue validation.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+        uses: nix-forge/ci/actions/queue-completion@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index dd25ddf..c44c01d 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -149,4 +149,4 @@ jobs:
       actions: write # Notify the trusted default-branch reconciler.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0-compatible
+        uses: nix-forge/ci/actions/queue-completion@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
diff --git a/.github/workflows/reconcile-merge-queue.yml b/.github/workflows/reconcile-merge-queue.yml
index ce19e57..f34e072 100644
--- a/.github/workflows/reconcile-merge-queue.yml
+++ b/.github/workflows/reconcile-merge-queue.yml
@@ -32,7 +32,7 @@ jobs:
       statuses: write # Report verified queue job results.
     steps:
       - name: Reconcile verified automation
-        uses: nix-forge/ci/actions/reconcile-queue@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+        uses: nix-forge/ci/actions/reconcile-queue@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
         with:
           workflows: '["ci.yml", "codeql.yml", "dco.yml"]'
           base-sha-workflows: '["dco.yml"]'
diff --git a/.github/workflows/retry-scorecard.yml b/.github/workflows/retry-scorecard.yml
new file mode 100644
index 0000000..8d931dc
--- /dev/null
+++ b/.github/workflows/retry-scorecard.yml
@@ -0,0 +1,18 @@
+name: Recover transient Scorecard failures
+on: # zizmor: ignore[dangerous-triggers] Trusted metadata-only recovery, without caller checkout.
+  workflow_run:
+    workflows: ["OpenSSF Scorecard"]
+    types: [completed]
+permissions: {}
+concurrency:
+  group: recover-scorecard-${{ github.event.workflow_run.id }}
+  cancel-in-progress: false
+jobs:
+  retry:
+    if: github.event.workflow_run.conclusion == 'failure'
+    permissions:
+      actions: write # Retry only verified transient service failures.
+      contents: read
+    uses: nix-forge/ci/.github/workflows/retry-scorecard.yml@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+    with:
+      source-run-id: ${{ format('{0}', github.event.workflow_run.id) }}
diff --git a/workflow-templates/dependency-review.yml b/workflow-templates/dependency-review.yml
index c67f95c..825a648 100644
--- a/workflow-templates/dependency-review.yml
+++ b/workflow-templates/dependency-review.yml
@@ -12,4 +12,4 @@ jobs:
     name: Dependency review
     permissions:
       contents: read
-    uses: nix-forge/ci/.github/workflows/dependency-review.yml@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+    uses: nix-forge/ci/.github/workflows/dependency-review.yml@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
diff --git a/workflow-templates/nix-checks.yml b/workflow-templates/nix-checks.yml
index 92e8103..e230934 100644
--- a/workflow-templates/nix-checks.yml
+++ b/workflow-templates/nix-checks.yml
@@ -23,7 +23,7 @@ jobs:
         with:
           persist-credentials: false
       - id: inventory
-        uses: nix-forge/ci/actions/discover-lockfiles@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+        uses: nix-forge/ci/actions/discover-lockfiles@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
   lock-health:
     name: Flake lock health
     needs: [lock]
@@ -45,7 +45,7 @@ jobs:
       fail-fast: false
       matrix:
         lockfile: ${{ fromJSON(needs.discover.outputs.lockfiles) }}
-    uses: nix-forge/ci/.github/workflows/flake-lock.yml@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+    uses: nix-forge/ci/.github/workflows/flake-lock.yml@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
     with:
       lockfile: ${{ matrix.lockfile }}
   checks:
@@ -58,10 +58,10 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: nix-forge/ci/actions/setup-nix@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+      - uses: nix-forge/ci/actions/setup-nix@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
       - name: Validate workflow contracts
-        uses: nix-forge/ci/actions/validate-workflows@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+        uses: nix-forge/ci/actions/validate-workflows@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
       - name: Materialize discovered partitions
-        uses: nix-forge/ci/actions/materialize-partitions@13ad6e366ec01e317705d750fc512d33ecc15f6c # v2.9.0
+        uses: nix-forge/ci/actions/materialize-partitions@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
       - name: Run declared repository checks
         run: nix flake check --keep-going --print-build-logs
diff --git a/workflow-templates/retry-scorecard.properties.json b/workflow-templates/retry-scorecard.properties.json
new file mode 100644
index 0000000..6895612
--- /dev/null
+++ b/workflow-templates/retry-scorecard.properties.json
@@ -0,0 +1,11 @@
+{
+  "name": "Recover transient Scorecard failures",
+  "description": "Automatically retry current default-branch Scorecard runs after verified transient GitHub GraphQL outages, at most twice.",
+  "iconName": "octicon shield-check",
+  "categories": [
+    "security"
+  ],
+  "filePatterns": [
+    "*"
+  ]
+}
diff --git a/workflow-templates/retry-scorecard.yml b/workflow-templates/retry-scorecard.yml
new file mode 100644
index 0000000..8d931dc
--- /dev/null
+++ b/workflow-templates/retry-scorecard.yml
@@ -0,0 +1,18 @@
+name: Recover transient Scorecard failures
+on: # zizmor: ignore[dangerous-triggers] Trusted metadata-only recovery, without caller checkout.
+  workflow_run:
+    workflows: ["OpenSSF Scorecard"]
+    types: [completed]
+permissions: {}
+concurrency:
+  group: recover-scorecard-${{ github.event.workflow_run.id }}
+  cancel-in-progress: false
+jobs:
+  retry:
+    if: github.event.workflow_run.conclusion == 'failure'
+    permissions:
+      actions: write # Retry only verified transient service failures.
+      contents: read
+    uses: nix-forge/ci/.github/workflows/retry-scorecard.yml@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+    with:
+      source-run-id: ${{ format('{0}', github.event.workflow_run.id) }}