diff --git a/.github/workflows/pages-deploy.yml b/.github/workflows/pages-deploy.yml
index aa7b56da..6679fbb0 100644
--- a/.github/workflows/pages-deploy.yml
+++ b/.github/workflows/pages-deploy.yml
@@ -18,7 +18,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Deploy site/ to Cloudflare Workers (static assets)
         run: npx wrangler@latest deploy
         env:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 006ab206..1b09c482 100755
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -23,9 +23,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 0eab2e6f..e5df9dc6 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,6 +31,14 @@ permissions:
 jobs:
   analysis:
     permissions:
+      # `contents: read` is REQUIRED, not redundant. Declaring `permissions:`
+      # at job level sets every unlisted scope to `none`, and a called
+      # workflow can never hold more than the calling job grants it. The
+      # reusable declares top-level `permissions: contents: read` and its
+      # first step is actions/checkout, so omitting `contents` here handed
+      # it `contents: none` and the call died at startup with zero jobs.
+      # The green sibling (boj-server-cartridges) lists all three.
+      contents: read
       security-events: write
       id-token: write
     uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@8813ecf2a841335c9dc14c75cc46694722cd6d28