diff --git a/.github/workflows/lean-proofs.yml b/.github/workflows/lean-proofs.yml
index d1f66b8..0ad0707 100644
--- a/.github/workflows/lean-proofs.yml
+++ b/.github/workflows/lean-proofs.yml
@@ -57,19 +57,19 @@ jobs:
           lean docs/proofs/verification/WokeGrammarStructure.lean
           echo "✅ WokeGrammarStructure.lean verified"
 
-      - name: Verify WokeGrammarRegular.lean (§7.1 not-regular: DFA + pigeonhole)
+      - name: "Verify WokeGrammarRegular.lean (§7.1 not-regular: DFA + pigeonhole)"
         run: |
           set -euo pipefail
           lean docs/proofs/verification/WokeGrammarRegular.lean
           echo "✅ WokeGrammarRegular.lean verified"
 
-      - name: Verify WokeGrammarCFL.lean (§7.3 CFL closure: union/concat/star)
+      - name: "Verify WokeGrammarCFL.lean (§7.3 CFL closure: union/concat/star)"
         run: |
           set -euo pipefail
           lean docs/proofs/verification/WokeGrammarCFL.lean
           echo "✅ WokeGrammarCFL.lean verified"
 
-      - name: Verify WokeGrammarPumping.lean (§7.3 non-closure: pumping foundation)
+      - name: "Verify WokeGrammarPumping.lean (§7.3 non-closure: pumping foundation)"
         run: |
           set -euo pipefail
           lean docs/proofs/verification/WokeGrammarPumping.lean
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 664f803..6c8ddaf 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -10,7 +10,7 @@ concurrency:
 permissions:
   contents: read
 jobs:
-scan:
+  scan:
     # The reusable's gitleaks job requests pull-requests: write (PR summary
     # comment) and actions: read (workflow-run metadata) at job level; the
     # caller must grant at least that or the run startup-fails.