diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 9be47cd..504facc 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,8 +1,23 @@
-# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 # This workflow is managed by gh actions-lock.
 name: Secret Scanner
 
+# Calls the published cicd-suite scanner, as gitbot-fleet does. The context
+# this repository's ruleset requires, scan / gitleaks, is produced by the
+# callee's gitleaks job (its supplemental matrix also reports
+# scan / rust-secrets and scan / shell-secrets).
+#
+# The previous caller called metadatastician/standards, which this
+# repository's Actions settings do not allow, so every run failed at
+# startup with zero jobs.
+#
+# Boundaries:
+#   * `fast-pr` stays false: every run scans full history.
+#   * No `secrets:` line. The callee declares no workflow_call secret and
+#     installs its own checksum-pinned binary, so `secrets: inherit` would
+#     forward every repository and organisation secret for no benefit.
+#   * `contents: read` is the whole grant the callee's jobs declare.
+
 on:
   pull_request:
   push:
@@ -13,13 +28,14 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  actions: read
   contents: read
 
 jobs:
   scan:
+    # This job-level block REPLACES the workflow-level one. Granting less than
+    # the callee's jobs declare rejects the run at startup with zero jobs.
     permissions:
-      actions: read
-      security-events: write
       contents: read
-    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@a797d308c0517d4e2d21cc7f1cb08d41f82b1a12
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
+    with:
+      fast-pr: false