diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index af3eeaa..faf95df 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -1,13 +1,14 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# Thin wrapper around hyperpolymath/standards codeql-reusable.yml.
+# Thin wrapper around metadatastician/standards codeql-reusable.yml.
 # Matches the echidna sibling-repo pattern (estate-wide consolidation:
 # 263 deployments, 69 unique SHAs, 26% structural drift). Default
 # language is javascript-typescript (84.8% of estate); the reusable is
 # single-language / single-job by design — multi-language wrappers
-# call the reusable once per language. echidnabot is JS/TS today, so
-# the default suffices.
+# call the reusable once per language. echidnabot is a Rust crate with no
+# JavaScript or TypeScript file, so this caller passes `language: rust`.
+# A second job scans the workflow files (`language: actions`).
 name: CodeQL Security Analysis
 on:
   push:
@@ -31,4 +32,14 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01
+    uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main as of 2026-06-01
+    with:
+      language: rust
+  analyze-actions:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: metadatastician/standards/.github/workflows/codeql-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
+    with:
+      language: actions
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 4756b4a..8e31dfb 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -19,4 +19,4 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index 0586a77..e2259f2 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -11,7 +11,7 @@ permissions:
   contents: read
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305)
+    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-30 (Radicle + Instant-Sync secret-presence gating #305)
     secrets:
       GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
       BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index 133fbd4..8966e42 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -13,7 +13,7 @@ permissions:
   contents: read
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-31 (CI/CD campaigns C001-C005)
+    uses: metadatastician/standards/.github/workflows/rust-ci-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7 # main 2026-05-31 (CI/CD campaigns C001-C005)
     # The crate's library suite is known to hang past 20 minutes. Keep the
     # ordinary PR gate aligned with publish.yml: run every named integration
     # suite explicitly while the library-test deadlock is tracked separately.
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 01b7929..a88a75e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
+    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@740c9d7d4ed4d1f319a04c92b28218beb75668d7
     permissions:
       actions: read
       contents: read