diff --git a/.github/workflows/deno-ci.yml b/.github/workflows/deno-ci.yml
index 5537219..29e191c 100644
--- a/.github/workflows/deno-ci.yml
+++ b/.github/workflows/deno-ci.yml
@@ -18,4 +18,4 @@ permissions:
 
 jobs:
   deno-ci:
-    uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # standards#168 head
+    uses: hyperpolymath/standards/.github/workflows/deno-ci-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # standards#168 head
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 235c601..829527d 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -28,8 +28,9 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4 # main 2026-05-27 (post-#219 workflow_sha fix)
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4 # main 2026-05-27 (post-#219 workflow_sha fix)
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 8df8727..d96e21a 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -20,11 +20,12 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
+  actions: read
   contents: read
-  security-events: write
   pull-requests: write
+  security-events: write
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
-    secrets: inherit
\ No newline at end of file
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    secrets: inherit
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 797be50..5a1be21 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -8,9 +8,10 @@ on:
   workflow_dispatch:
 
 permissions:
+  actions: read
   contents: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index b9b3dd8..8d0b54c 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     with:
       enable_audit: true
       enable_coverage: true
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index df71468..3efc3d0 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -16,5 +16,5 @@ jobs:
     permissions:
       security-events: write
       id-token: write
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 2e351e7..436d61a 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -20,5 +20,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@fcb8669169b4e9f5d9848608df880ae5fae812b4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
     secrets: inherit
\ No newline at end of file