diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index ad78af7..2e261ac 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,10 +1,12 @@
 # This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
-# Caller of the estate secret scanner in hyperpolymath/proven-cicd, at the
-# version that gitbot-fleet calls. gitbot-fleet has a pinned copy of this
-# crate (bots/echidnabot/), so a line that fails the scan there must fail
-# here first.
+# Caller of the estate secret scanner in hyperpolymath/proven-cicd-and-workflows
+# (proven-cicd is retired; its commits are merged there). The pin is a
+# descendant of the commit that gitbot-fleet calls (03e858b), and the
+# reusable differs from it only in the caller check, which admits the new
+# name. gitbot-fleet has a pinned copy of this crate (bots/echidnabot/), so a
+# line that fails the scan there must fail here first.
 #
 # The earlier caller named hyperpolymath/standards at 740c9d7. It did not
 # start: each run ended at creation, with no job and no check.
@@ -30,6 +32,6 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@03e858b6015e67cc1f9bc31ac1e29ddc1b6fd409
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
     with:
       fast-pr: false