diff --git a/.github/workflows/creusot-live-canary.yml b/.github/workflows/creusot-live-canary.yml
index 36eb6fe..e0e6d09 100644
--- a/.github/workflows/creusot-live-canary.yml
+++ b/.github/workflows/creusot-live-canary.yml
@@ -27,7 +27,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          git merge-base --is-ancestor 6c6d772ebe82605ba22254db528faf54faec9f49 origin/main
+          git merge-base --is-ancestor 1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 origin/main
       - name: Fixture prerequisites and missing-prerequisite mutants (not proof)
         shell: bash
         run: |
@@ -38,7 +38,7 @@ jobs:
           git diff --exit-code -- tests/fixtures/creusot-live
   creusot:
     needs: fixture
-    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@6c6d772ebe82605ba22254db528faf54faec9f49 # published PR70 repair
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6 # published PR 94 merge: admits this repository name
     with:
       working_directory: tests/fixtures/creusot-live
       creusot_version: '0.14.0'
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index c2e4a30..2f0516a 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -16,7 +16,7 @@ concurrency:
   cancel-in-progress: true
 jobs:
   scan:
-    uses: hyperpolymath/proven-cicd/.github/workflows/secret-scanner-reusable.yml@a12b2b4644db1a1250bc50b58fd24c99f89f564e
+    uses: hyperpolymath/proven-cicd-and-workflows/.github/workflows/secret-scanner-reusable.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
     with:
       # Keep false until an initial full audit passes and the security owner
       # accepts introduced-commit PR coverage. All non-PR runs remain full.
diff --git a/README.adoc b/README.adoc
index 6be1562..b9c67f0 100644
--- a/README.adoc
+++ b/README.adoc
@@ -312,6 +312,9 @@ jobs:
 Pin a full SHA, never `+@main+` or a tag: the account enforces
 `+sha_pinning_required+`, and `+@main+` would silently change the gate in
 every consuming repository at once.
+Pin a commit that contains the migrated `+main-estate-audit.yml+`
+(`+1fd5e63+` or later). An earlier commit still names
+`+hyperpolymath/cicd-suite+` in its steps.
 . The caller must be *de-onboarded* from the repository's
 `+actions.lock+`. Onboarded, a cross-repository reusable-workflow call
 startup-fails with zero jobs. `+scripts/deonboard-estate-audit.sh <repo>+`
diff --git a/config/workflow-lock-scope.json b/config/workflow-lock-scope.json
index 30fad93..5b2b22c 100644
--- a/config/workflow-lock-scope.json
+++ b/config/workflow-lock-scope.json
@@ -24,7 +24,7 @@
     {
       "path": ".github/workflows/creusot-live-canary.yml",
       "mode": "immutable",
-      "reason": "Narrow real-tool canary pinned to the published PR70 repair; not lock-map onboarding or broad consumer rollout."
+      "reason": "Narrow real-tool canary pinned to a published suite commit; not lock-map onboarding or broad consumer rollout."
     },
     {
       "path": ".github/workflows/kanren-gate.yml",
diff --git a/templates/track-estate-audit.yml b/templates/track-estate-audit.yml
index 08c9f5f..b7b1a25 100644
--- a/templates/track-estate-audit.yml
+++ b/templates/track-estate-audit.yml
@@ -91,9 +91,12 @@ jobs:
                 continue
               fi
               echo "$caller: ${pinned:0:7} -> ${head:0:7}"
-              sed -i "s/$pinned/$head/g" "$caller"
+              # Move the SHA only in a complete uses: reference to this
+              # suite under hyperpolymath. The same SHA in a reference to
+              # another owner (a fork) stays as it is.
+              sed -i -E "s#(uses:[[:space:]]*[\"']?hyperpolymath/(cicd-suite|proven-cicd-and-workflows)/\.github/workflows/[A-Za-z0-9_.-]+\.yml@)$pinned#\1$head#g" "$caller"
               changed=1
-            done < <(grep -oE '(cicd-suite|proven-cicd-and-workflows)/\.github/workflows/[A-Za-z0-9_.-]+\.yml@[0-9a-f]{40}' "$caller" | sed 's/.*@//' | sort -u)
+            done < <(grep -oE 'uses:[[:space:]]*["'"'"']?hyperpolymath/(cicd-suite|proven-cicd-and-workflows)/\.github/workflows/[A-Za-z0-9_.-]+\.yml@[0-9a-f]{40}' "$caller" | sed 's/.*@//' | sort -u)
             # The suite was renamed from cicd-suite on 2026-11-09. A uses: line
             # naming the old repository startup-fails (Actions does not follow
             # renames), so move the coordinate along with the SHA.
diff --git a/tests/creusot-live-canary.sh b/tests/creusot-live-canary.sh
index 62b048a..03e3cb9 100644
--- a/tests/creusot-live-canary.sh
+++ b/tests/creusot-live-canary.sh
@@ -7,7 +7,7 @@ command -v cargo >/dev/null || { echo 'real Cargo required' >&2; exit 2; }
 yq --version | grep -q 'mikefarah/yq' || { echo 'mikefarah yq required' >&2; exit 2; }
 tmp=$(mktemp -d)
 trap 'rm -rf "$tmp"' EXIT
-pin=hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@6c6d772ebe82605ba22254db528faf54faec9f49
+pin=hyperpolymath/proven-cicd-and-workflows/.github/workflows/creusot-gate.yml@1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6
 
 # Validate the bounded input and call contract. Every failure propagates even
 # when this function is called in an `if` (where Bash suppresses errexit).
@@ -73,7 +73,7 @@ stage
 rm "$tmp/tree/tests/fixtures/creusot-live/Cargo.lock"
 reject 'missing Cargo.lock'
 stage
-sed -i 's/6c6d772ebe82605ba22254db528faf54faec9f49/main/g' "$tmp/tree/.github/workflows/creusot-live-canary.yml"
+sed -i 's/1fd5e6371a50f0fc3687206a5adca0cdf7b39aa6/main/g' "$tmp/tree/.github/workflows/creusot-live-canary.yml"
 reject 'floating gate pin'
 stage
 sed -i 's/creusot-std = "=0.14.0"/creusot-std = "=0.13.0"/' "$tmp/tree/tests/fixtures/creusot-live/Cargo.toml"