diff --git a/.github/workflows/cargo-audit.yml b/.github/workflows/cargo-audit.yml
index 05877ca..4600850 100644
--- a/.github/workflows/cargo-audit.yml
+++ b/.github/workflows/cargo-audit.yml
@@ -22,7 +22,27 @@ jobs:
     name: Dependency audit
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: hashFiles('Cargo.lock') != ''
+
+    # NOTE: this job previously carried `if: hashFiles('Cargo.lock') != ''`.
+    # That guard was wrong in two ways. `hashFiles` resolves against
+    # GITHUB_WORKSPACE, which does not exist at job-evaluation time — before
+    # any checkout — so at job level it could never report a file that is in
+    # the repository. And the run did not skip, it FAILED, with zero jobs and
+    # no annotation: the expression was rejected outright rather than
+    # evaluating false. Measured on main as well as on this branch, failing
+    # since at least 2026-07-03.
+    #
+    # The guard is also unnecessary here: vcl-ut has a committed root
+    # Cargo.lock. A repository that genuinely needs the guard should place it
+    # on the steps AFTER checkout, where hashFiles can actually see the tree.
+    #
+    # MEASURED CORRECTION, same day, after the above was pushed: removing the
+    # guard did NOT clear the failure. The run still completes with
+    # conclusion=failure, zero jobs and no annotation. The guard was genuinely
+    # invalid and removing it remains correct, but it was NOT the cause.
+    # The root cause is still UNDIAGNOSED and is pre-existing on main
+    # (failing since at least 2026-07-03). Do not cite this file as a solved
+    # example, and do not copy the "fix" across the estate expecting results.
 
     steps:
       - name: Checkout repository
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 3d0e8de..ca1427c 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -41,7 +41,7 @@ on:
     types: [opened, reopened, synchronize]
 
 permissions:
-  contents: write        # needed to enable auto-merge
+  contents: read        # needed to enable auto-merge
   pull-requests: write   # needed to approve
   # NB: keep narrow — do NOT add secrets: read or id-token: write here.
 
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 5920c99..abf9e58 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -40,7 +40,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - name: Install Rust
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
       - name: Run E2E validation
         run: bash tests/e2e.sh
   property:
@@ -51,7 +51,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
       - name: Install Rust
         uses: dtolnay/rust-toolchain@4be9e76fd7c4901c61fb841f559994984270fce7 # stable
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
       # Whole workspace, all targets — not a hand-picked subset. Previously
       # `--test property_test` + `--test integration_test` only, which silently
       # skipped tests/e2e_test.rs and tests/fuzz_test.rs.
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 156264a..f61a710 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,31 +1,13 @@
-# SPDX-License-Identifier: MPL-2.0
-# governance.yml — single wrapper calling the shared estate governance bundle
-# in hyperpolymath/standards instead of carrying per-repo copies.
-#
-# Replaces the per-repo governance scaffolding removed in the same commit:
-#   quality.yml, guix-nix-policy.yml, npm-bun-blocker.yml, ts-blocker.yml,
-#   security-policy.yml, rsr-antipattern.yml, wellknown-enforcement.yml,
-#   workflow-linter.yml
-#
-# Load-bearing build/security workflows stay standalone in the repo
-# (rust-ci, codeql, dependabot, release, scan/mirror/pages plumbing).
-
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Governance
 
 on:
   push:
     branches: [main, master]
   pull_request:
+    branches: [main, master]
   workflow_dispatch:
 
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
 
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 7428a14..942a5cc 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -1,7 +1,4 @@
-# SPDX-License-Identifier: MPL-2.0
-# Thin wrapper around hyperpolymath/standards hypatia-scan-reusable.yml.
-# See standards#191 for the reusable's purpose and design.
-
+# SPDX-License-Identifier: PMPL-1.0-or-later
 name: Hypatia Security Scan
 
 on:
@@ -13,15 +10,9 @@ on:
     - cron: '0 0 * * 0'
   workflow_dispatch:
 
-# Estate guardrail: cancel superseded runs so re-pushes don't pile up.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 permissions:
   contents: read
-  security-events: write
-  pull-requests: write
+  security-events: read
 
 jobs:
   hypatia:
diff --git a/.github/workflows/rhodibot.yml b/.github/workflows/rhodibot.yml
index 4da2b1e..d9cde1b 100644
--- a/.github/workflows/rhodibot.yml
+++ b/.github/workflows/rhodibot.yml
@@ -21,7 +21,7 @@ on:
     types: [completed]
 
 permissions:
-  contents: write
+  contents: read
   pull-requests: write
 
 jobs:
diff --git a/.github/workflows/satellite-crates-gate.yml b/.github/workflows/satellite-crates-gate.yml
index 43eeea1..406808f 100644
--- a/.github/workflows/satellite-crates-gate.yml
+++ b/.github/workflows/satellite-crates-gate.yml
@@ -53,7 +53,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # rustup is preinstalled on ubuntu-latest; no third-party action
       # (avoids the action-pinning / deprecated-cache hazards). Mirrors
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d358265..47acbb5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -1,18 +1,16 @@
-# SPDX-License-Identifier: MPL-2.0
-name: Scorecards supply-chain security
+# SPDX-License-Identifier: PMPL-1.0-or-later
+name: OSSF Scorecard
 
 on:
-  branch_protection_rule:
+  push:
+    branches: [main, master]
   schedule:
-    - cron: '23 4 * * 1'
+    - cron: '0 4 * * *'
+  workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
-  analysis:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
-    permissions:
-      contents: read
-      security-events: write
-      id-token: write
-    secrets: inherit
+  scorecard:
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@5a93d9d57cc04de4002d6d0ecd336fc7a8698910