diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index e50ead77..82e56a8a 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -60,7 +60,7 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@v1'
         - 'swatinem/rust-cache@v2.9.3'
-        - 'taiki-e/install-action@v2.87.32'
+        - 'taiki-e/install-action@v2.90.2'
     '.github/workflows/pages.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/deploy-pages@v5.0.1'
@@ -76,13 +76,12 @@ workflows:
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@v1'
         - 'swatinem/rust-cache@v2.9.3'
-        - 'taiki-e/install-action@v2.87.32'
+        - 'taiki-e/install-action@v2.90.2'
     '.github/workflows/scorecard.yml':
         - 'metadatastician/standards@d3e4b485a2af90c92a8e18af0888cd19cb132cd9'
     '.github/workflows/secret-scanner.yml':
         - 'hyperpolymath/proven-cicd-and-workflows@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6'
-    '.github/workflows/security-scan.yml':
-        - 'hyperpolymath/panic-attack@55ffcc9a240e937edd968487af15ab45c6f0522f'
+    '.github/workflows/security-scan.yml': []
     '.github/workflows/server-boot-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'dtolnay/rust-toolchain@v1'
@@ -103,11 +102,6 @@ workflows:
         - 'hyperpolymath/proven-cicd-and-workflows@4c772eb235b04455307d5c03cbbc4f45130f7f0f'
         - 'mlugg/setup-zig@v2.2.1'
 dependencies:
-    'Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0':
-        ref: 'v2.9.3'
-        commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
-        owner_id: 580492
-        repo_id: 298565987
     'actions/attest-build-provenance@v4.2.2':
         ref: 'v4.2.2'
         commit: 'sha1-4d101475d8b20a2381f78447822ac1eab6504dd8'
@@ -227,15 +221,6 @@ dependencies:
         commit: 'sha1-884713a6c30a92e5e8544c39945cd7cb630abcd1'
         owner_id: 1342004
         repo_id: 400046858
-    'hyperpolymath/panic-attack@55ffcc9a240e937edd968487af15ab45c6f0522f':
-        ref: '55ffcc9a240e937edd968487af15ab45c6f0522f'
-        commit: 'sha1-55ffcc9a240e937edd968487af15ab45c6f0522f'
-        owner_id: 6759885
-        repo_id: 1152434997
-        uses:
-            - 'Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0'
-            - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
-            - 'dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8'
     'hyperpolymath/proven-cicd-and-workflows@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6':
         ref: '1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6'
         commit: 'sha1-1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6'
@@ -326,9 +311,9 @@ dependencies:
         commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
         owner_id: 580492
         repo_id: 298565987
-    'taiki-e/install-action@v2.87.32':
-        ref: 'v2.87.32'
-        commit: 'sha1-5488ac5a951645ce95062214902ac4b6bc1a1037'
+    'taiki-e/install-action@v2.90.2':
+        ref: 'v2.90.2'
+        commit: 'sha1-3a3daafd3b7f23b8f65d9f5ba2db203fb59b79e2'
         owner_id: 43724913
         repo_id: 442947557
     'webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555':
diff --git a/.github/workflows/mvp-smoke.yml b/.github/workflows/mvp-smoke.yml
index 8e4dcadd..9ccc697a 100644
--- a/.github/workflows/mvp-smoke.yml
+++ b/.github/workflows/mvp-smoke.yml
@@ -46,7 +46,7 @@ jobs:
         uses: Swatinem/rust-cache@v2.9.3
 
       - name: Install just
-        uses: taiki-e/install-action@v2.87.32
+        uses: taiki-e/install-action@v2.90.2
         with:
           # Governance R1 requires versioned family-tool pins
           # (just|must|trust|adjust|bust|dust|intend); bare `tool: just`
diff --git a/.github/workflows/s4-loop.yml b/.github/workflows/s4-loop.yml
index a8bfda85..29676820 100644
--- a/.github/workflows/s4-loop.yml
+++ b/.github/workflows/s4-loop.yml
@@ -42,7 +42,7 @@ jobs:
       - name: Cache Cargo
         uses: Swatinem/rust-cache@v2.9.3
       - name: Install just
-        uses: taiki-e/install-action@v2.87.32
+        uses: taiki-e/install-action@v2.90.2
         with:
           tool: just@1.51.0
       - name: Install system dependencies
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index d880996b..ce1c5350 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -24,6 +24,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@55ffcc9a240e937edd968487af15ab45c6f0522f # main 2026-11-10: builds the scanner at the workflow commit, not the caller (panic-attack#276)
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@15868fee549383c063a4efcf8eaaa75616189943 # main 2026-11-10: builds the scanner at the workflow commit, not the caller (panic-attack#276)
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}