diff --git a/.github/workflows/claim-sweep.yml b/.github/workflows/claim-sweep.yml
index 318a448..e39c01c 100644
--- a/.github/workflows/claim-sweep.yml
+++ b/.github/workflows/claim-sweep.yml
@@ -69,7 +69,7 @@ concurrency:
 jobs:
   sweep:
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@14c1a9b3ade8bb6416f46c890eda21823647da09
+    uses: bounded-systems/.github/.github/workflows/_claim-sweep.yml@63715f952022f2edfef72c0a4a0ec94e48e51e71
     permissions:
       contents: read
       issues: write
diff --git a/.github/workflows/deps.yml b/.github/workflows/deps.yml
index b34ad0a..69eecb0 100644
--- a/.github/workflows/deps.yml
+++ b/.github/workflows/deps.yml
@@ -43,4 +43,4 @@ jobs:
   osv:
     # SHA-pinned per org policy. `# main` records what the SHA was at the time, so a
     # reviewer can tell an intentional bump from a drifted one.
-    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@30978ba6776c30081379e23fa20a12f36db3a48c # main
+    uses: bounded-systems/ci-workflows/.github/workflows/osv-scan.yml@fb7ca62fd9fb8af90af1097a0b21ee703c103dc4 # main
diff --git a/.github/workflows/front-desk-add.yml b/.github/workflows/front-desk-add.yml
index d68f9e5..df66e4f 100644
--- a/.github/workflows/front-desk-add.yml
+++ b/.github/workflows/front-desk-add.yml
@@ -59,7 +59,7 @@ jobs:
         id: app-token
         if: ${{ vars.CF_BROKER_URL != '' }}
         continue-on-error: true
-        uses: bounded-systems/.github/.github/actions/broker-gh-token@63fb16d135258a3acfbfe4ceb4db5c2a17f7dc1f # broker-gh-token (prx-26bq), .github#109
+        uses: bounded-systems/.github/.github/actions/broker-gh-token@63715f952022f2edfef72c0a4a0ec94e48e51e71 # broker-gh-token (prx-26bq), .github#109
         with:
           app: front-desk
           broker-url: ${{ vars.CF_BROKER_URL }}
diff --git a/.github/workflows/pr-claim.yml b/.github/workflows/pr-claim.yml
index 871c69f..fd19061 100644
--- a/.github/workflows/pr-claim.yml
+++ b/.github/workflows/pr-claim.yml
@@ -81,4 +81,4 @@ jobs:
       issues: read
       pull-requests: read
     # SHA-pinned, per org policy — never a branch.
-    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@bc4cb7dada47cc59eed416372a4851201bd6f503
+    uses: bounded-systems/.github/.github/workflows/_pr-claim.yml@63715f952022f2edfef72c0a4a0ec94e48e51e71