diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index 7162c52..be1ac76 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -11,7 +11,9 @@ on:
 
 permissions:
   contents: read
+  # The reusable declares actions: read at workflow level (metadatastician/standards @ e064539).
+  actions: read
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
+    uses: metadatastician/standards/.github/workflows/governance-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index c534530..002563e 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -21,4 +21,4 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
+    uses: metadatastician/standards/.github/workflows/hypatia-scan-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index c003271..08dd514 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -9,8 +9,19 @@ on:
 
 permissions:
   contents: read
+  # The reusable declares actions: read at workflow level (metadatastician/standards @ e064539).
+  actions: read
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
-    secrets: inherit
+    uses: metadatastician/standards/.github/workflows/mirror-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
+    # Named, not inherited: the reusable declares exactly these, and skips a
+    # forge whose key is not set.
+    secrets:
+      GITLAB_SSH_KEY: ${{ secrets.GITLAB_SSH_KEY }}
+      BITBUCKET_SSH_KEY: ${{ secrets.BITBUCKET_SSH_KEY }}
+      CODEBERG_SSH_KEY: ${{ secrets.CODEBERG_SSH_KEY }}
+      SOURCEHUT_SSH_KEY: ${{ secrets.SOURCEHUT_SSH_KEY }}
+      DISROOT_SSH_KEY: ${{ secrets.DISROOT_SSH_KEY }}
+      GITEA_SSH_KEY: ${{ secrets.GITEA_SSH_KEY }}
+      RADICLE_KEY: ${{ secrets.RADICLE_KEY }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c9aa653..e850051 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
+    uses: metadatastician/standards/.github/workflows/scorecard-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 4256c8f..cfe80c0 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -16,10 +16,8 @@ permissions:
 
 jobs:
   scan:
-    # The reusable's gitleaks job requests pull-requests: write (PR summary
-    # comment) and actions: read (workflow-run metadata) at job level; the
-    # caller must grant at least that or the run startup-fails.
+    # At metadatastician/standards @ e064539 the reusable's jobs ask for
+    # contents: read only, and it declares no secrets, so none are passed.
     permissions:
       contents: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@da2c748aad55c1a1dcba00b60fe4a35017bc6540
-    secrets: inherit
+    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@e064539116c2dcfdf282a4749dbd58c69961c7e6
diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc
index d2c5d68..6637159 100644
--- a/CHANGELOG.adoc
+++ b/CHANGELOG.adoc
@@ -9,6 +9,19 @@ https://semver.org/spec/v2.0.0.html[Semantic Versioning].
 
 === [Unreleased]
 
+==== CI: standards re-pinned to metadatastician @ `e064539` (2026-11-09)
+
+* The five standards reusables (governance, hypatia-scan, mirror, scorecard,
+  secret-scanner) move from `hyperpolymath/standards@da2c748` to
+  `metadatastician/standards@e064539`, the commit panll runs green
+  (hyperpolymath/panll#171). At `da2c748` all five failed at startup on
+  every push, so the required `scan / gitleaks` check never reported.
+* `governance.yml` and `mirror.yml` grant `actions: read`, which both
+  reusables declare at workflow level at `e064539`.
+* `mirror.yml` passes the seven forge keys the reusable declares by name,
+  and `secret-scanner.yml` passes none (its reusable declares none), instead
+  of `secrets: inherit`, which handed every repository secret to the callee.
+
 ==== L15-C at the front-end: a caller's caps contain its callee's (2026-10-27)
 
 * The canonical Rust front-end (`typed-wasm-codegen`, ADR-0006) now parses