diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 63078c0..ad7e1f4 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -15,9 +15,9 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
-    secrets: inherit
+    # Canonical standards owner after transfer; exact reviewed commit pin.
+    # The reusable runs pinned local scanners with contents: read only and
+    # explicitly declares no workflow_call secrets. Do not inherit secrets.
+    uses: metadatastician/standards/.github/workflows/secret-scanner-reusable.yml@8e48b1caade08a552646adeab66558ac43b4360d
     permissions:
-      actions: read
       contents: read
-      security-events: write