diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 57fb26b..472623b 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -38,7 +38,8 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/rust-ci.yml': []
     '.github/workflows/scorecard.yml': []
-    '.github/workflows/secret-scanner.yml': []
+    '.github/workflows/secret-scanner.yml':
+        - 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1'
     '.github/workflows/static-analysis-gate.yml':
         - 'actions/checkout@v7.0.1'
         - 'actions/download-artifact@v8.0.2'
@@ -50,6 +51,11 @@ dependencies:
         commit: 'sha1-55cc8345863c7cc4c66a329aec7e433d2d1c52a9'
         owner_id: 44036562
         repo_id: 215566462
+    'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
     'actions/checkout@v7.0.1':
         ref: 'v7.0.1'
         commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index a6a596c..80b9c5e 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -14,10 +14,14 @@ concurrency:
   cancel-in-progress: true
 
 permissions:
-  actions: read
   contents: read
 
 jobs:
   scan:
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@84355587cb2a1f86e6882de83514a32db2646e7a
-    secrets: inherit
+    # Keep this direct scan caller and its required scan / gitleaks context.
+    # The pinned reusable only needs contents: read and no inherited secrets.
+    # Its checkout edge is explicit in actions.lock: gh actions-lock cannot
+    # discover remote job-level reusable calls, so retain it on regeneration.
+    uses: hyperpolymath/cicd-suite/.github/workflows/secret-scanner-reusable.yml@4404c3c0474e17753fe7689f3485c02890aac113
+    with:
+      fast-pr: false # Preserve full-history PR scanning.