diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 16526da..ea3a07e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,6 +23,22 @@
 # top and granted per job, every action pinned to a commit with its version in a
 # comment, and checkout without persisted credentials. The one write scope here
 # is security-events, which is what uploading the results needs and nothing more.
+#
+# The version in that comment is the exact one the pinned commit is tagged as,
+# never the major. Both spellings leave the same commit running, so the whole
+# difference is in what the comment claims. A comment reading v4 is a claim about
+# a reference upstream moves, and it stops being true on the day upstream tags a
+# release without anybody here touching a file; an exact version is a claim about
+# the commit written next to it, which cannot go stale on its own. The two steps
+# below carried a major until this comment landed, and were the only two sites in
+# this tree that did. The command that says so prints nothing now, and printing
+# nothing is the state to keep it in:
+#
+#   git grep -nE 'uses: .*@[0-9a-f]{40} # v[0-9]+$' -- .github/workflows/
+#
+# The audit in zizmor.yml reads the comment against the tags the pinned commit
+# carries and fails the build on a mismatch, so the spelling is held by a check
+# rather than by memory.
 name: CodeQL
 
 on:
@@ -68,7 +84,7 @@ jobs:
           cache: false
 
       - name: Initialise CodeQL
-        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           languages: go
           # Manual rather than autobuild, because autobuild builds the module
@@ -86,6 +102,6 @@ jobs:
         run: go build ./cmd/... ./internal/...
 
       - name: Analyse
-        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
         with:
           category: "/language:go"
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 8ab1a87..c909ee2 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -11,13 +11,20 @@
 # regular persona is the one zizmor documents for CI ("high-signal, low-noise,
 # actionable"). The pedantic persona is deliberately NOT used to gate: it adds
 # low-severity hygiene findings (undocumented permissions, missing concurrency,
-# pin-comment mismatches, unnamed jobs) that are stylistic, not security-blocking,
-# and some are context-blind (it would demand run-cancelling concurrency on a
-# publishing workflow, which must never be cancelled mid-publish). Those findings
-# are not gated here, and no issue on this tracker collects them today.
+# unnamed jobs) that are stylistic, not security-blocking, and some are
+# context-blind (it would demand run-cancelling concurrency on a publishing
+# workflow, which must never be cancelled mid-publish). Those findings are not
+# gated here, and no issue on this tracker collects them today.
+#
+# A pin comment that disagrees with the commit beside it is NOT in that set. This
+# line listed it as a pedantic hygiene finding and that was wrong: the regular
+# persona reports ref-version-mismatch at medium, so the step below fails the
+# build on one. Two of them did exactly that on every pull request against this
+# board, which is what corrected this sentence.
 #
 # Rule for future workflow changes: every new or edited workflow must pass this
-# gate before merge. Keep actions SHA-pinned, keep checkout on
+# gate before merge. Keep actions SHA-pinned, comment each pin with the exact
+# version its commit is tagged as rather than the major, keep checkout on
 # persist-credentials:false, grant write permissions per job (never
 # workflow-level), and never restore a cache in a job that publishes a release.
 name: Workflow Security Analysis