diff --git a/.github/workflows/clusterfuzzlite.yml b/.github/workflows/clusterfuzzlite.yml
index cddb050f..e96eb825 100644
--- a/.github/workflows/clusterfuzzlite.yml
+++ b/.github/workflows/clusterfuzzlite.yml
@@ -12,8 +12,8 @@ on:
     - crates/**
     - fuzz/**
   schedule:
-  - cron: 0 2 * * 0
-  workflow_dispatch: null
+  - cron: '0 2 * * 0'
+  workflow_dispatch:
 
 permissions: read-all
 
diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index f8287c85..9311164e 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -16,4 +16,4 @@ permissions:
 
 jobs:
   governance:
-    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index 712a0eb8..22dab2ba 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -21,5 +21,5 @@ permissions:
 
 jobs:
   hypatia:
-    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/merge-orchestrate.yml b/.github/workflows/merge-orchestrate.yml
index cc5b1586..b20748fb 100644
--- a/.github/workflows/merge-orchestrate.yml
+++ b/.github/workflows/merge-orchestrate.yml
@@ -16,10 +16,10 @@
 name: Merge Orchestrate (scheduled)
 
 on:
-  workflow_dispatch: null
+  workflow_dispatch:
   schedule:
   # Hourly, offset off the top of the hour to dodge runner congestion.
-  - cron: 17 * * * *
+  - cron: '17 * * * *'
 
 concurrency:
   group: ${{ github.workflow }}
diff --git a/.github/workflows/mirror.yml b/.github/workflows/mirror.yml
index a4020d7d..8385e690 100644
--- a/.github/workflows/mirror.yml
+++ b/.github/workflows/mirror.yml
@@ -14,5 +14,5 @@ permissions:
 
 jobs:
   mirror:
-    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@7fdc2705df74b4e352d2a1cde3e87a5923fdf329
     secrets: inherit
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 093aefcb..12cb18d2 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -8,7 +8,7 @@ name: Docs & Code Quality
 on:
   push: null
   pull_request: null
-  workflow_dispatch: null
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ebf04a81..c7004384 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ name: Release & Container
 
 on:
   push: null
-  workflow_dispatch: null
+  workflow_dispatch:
 
 permissions: read-all
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 55491e95..224445f2 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -18,8 +18,9 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     permissions:
+      actions: read
       contents: read
       security-events: write
       id-token: write
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index d2053ce6..60e7f591 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -21,5 +21,5 @@ jobs:
       contents: read
       pull-requests: write
       actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@bd0df9ead7faf0cdfe0e13e7966d91e28d0101d4
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@db12a6ad3ef9076d5f7bdcf98d7d15cf8547555a
     secrets: inherit
diff --git a/.github/workflows/security-policy.yml b/.github/workflows/security-policy.yml
index 3d50375b..9499546a 100644
--- a/.github/workflows/security-policy.yml
+++ b/.github/workflows/security-policy.yml
@@ -15,9 +15,9 @@ on:
     - develop
     - main
   schedule:
-  - cron: 0 2 * * *
-  - cron: 0 3 * * 1
-  workflow_dispatch: null
+  - cron: '0 2 * * *'
+  - cron: '0 3 * * 1'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 37641a33..934ef841 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -10,12 +10,12 @@ on:
     branches:
     - main
   pull_request: null
-  workflow_dispatch: null
+  workflow_dispatch:
   schedule:
   # Daily 03:00 UTC — covers Mondays too. The Monday-only `0 3 * * 1`
   # cron from the pre-consolidation tests was a subset of the daily one
   # and was dropped to stop running this workflow twice on Mondays.
-  - cron: 0 3 * * *
+  - cron: '0 3 * * *'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
diff --git a/.github/workflows/verify-proofs.yml b/.github/workflows/verify-proofs.yml
index bfa58f35..d0f36b03 100644
--- a/.github/workflows/verify-proofs.yml
+++ b/.github/workflows/verify-proofs.yml
@@ -37,8 +37,8 @@ on:
   # 04:30, 05:00) were inherited from the pre-consolidation
   # verify-{idris,lean,tlaplus}.yml workflows and fired the now-merged
   # workflow three times every Monday. Collapsed to one.
-  - cron: 0 4 * * 1
-  workflow_dispatch: null
+  - cron: '0 4 * * 1'
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}