diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 5bca36a..d8abfd6 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -1,6 +1,13 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
+# Caller of the estate governance bundle in metadatastician/standards, at the
+# version that gitbot-fleet calls. gitbot-fleet has a pinned copy of this
+# crate (bots/echidnabot/), so a line that fails a governance gate there
+# (for example UUID conformance) must fail here first.
+#
+# The earlier caller named hyperpolymath/standards at 740c9d7. It did not
+# start: each run ended at creation, with no job and no check.
 name: Governance
 
 on:
@@ -16,4 +23,8 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@ea2f4d8a886585ed442687ae63d4ad7493379ba4
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index e1e065c..ad78af7 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,13 +1,18 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# Thin wrapper around hyperpolymath/standards secret-scanner-reusable.yml.
-# Matches the echidna sibling-repo pattern. The reusable contains the
-# canonical trufflehog + gitleaks + rust-secrets (+ shell-secrets)
-# bundle; routing through it force-promotes the post-Cloudflare-leak
-# shell-secrets guardrail (currently MISSING in this repo's bespoke
-# version) on the next sweep — direct security upgrade as a side
-# effect of the structural change.
+# Caller of the estate secret scanner in hyperpolymath/proven-cicd, at the
+# version that gitbot-fleet calls. gitbot-fleet has a pinned copy of this
+# crate (bots/echidnabot/), so a line that fails the scan there must fail
+# here first.
+#
+# The earlier caller named hyperpolymath/standards at 740c9d7. It did not
+# start: each run ended at creation, with no job and no check.
+#
+# Boundaries, as in the gitbot-fleet caller:
+#   * `fast-pr` is false: each run scans the full history.
+#   * No `secrets:` line. The callee declares no workflow_call secret.
+#   * `contents: read` is the whole grant.
 name: Secret Scanner
 on:
   pull_request:
@@ -25,4 +30,6 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01
+    uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409
+    with:
+      fast-pr: false