diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md
index 02f5fd9..d0e4d49 100644
--- a/.github/CONTRIBUTING.md
+++ b/.github/CONTRIBUTING.md
@@ -124,7 +124,7 @@ Footer: issue reference, e.g. Closes #123
 
 Every commit that reaches the default branch must be signed; a ruleset refuses
 unsigned pushes. Estate policy:
-[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
+[SIGNING-POLICY](https://github.com/metadatastician/standards/blob/main/docs/SIGNING-POLICY.adoc).
 
 - **People and interactive agents** sign with an SSH key registered on GitHub
   as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
diff --git a/.github/workflows/workflow-linter.yml b/.github/workflows/workflow-linter.yml
index 81a5ab6..931061b 100644
--- a/.github/workflows/workflow-linter.yml
+++ b/.github/workflows/workflow-linter.yml
@@ -22,7 +22,13 @@ jobs:
           errors=0
           for f in .github/workflows/*.yml .github/workflows/*.yaml; do
             [ -f "$f" ] || continue
-            if ! head -1 "$f" | grep -q "SPDX-License-Identifier"; then
+            # Scan the first five lines, not just the first. `gh actions-lock`
+            # prepends its own "# This workflow is managed by gh actions-lock."
+            # banner above the SPDX tag, so a compliant file has the identifier
+            # on line 2. Checking only line 1 flagged all 18 workflows as
+            # missing a header they in fact carry, and `exit $errors` turned
+            # that into exit code 18 -- a red check on a clean tree.
+            if ! head -5 "$f" | grep -q "SPDX-License-Identifier"; then
               echo "ERROR: $f missing SPDX header"
               errors=$((errors + 1))
             fi
diff --git a/CHANGELOG.adoc b/CHANGELOG.adoc
index 07441e4..1387236 100644
--- a/CHANGELOG.adoc
+++ b/CHANGELOG.adoc
@@ -3,10 +3,10 @@
 All notable changes to `+casket-ssg+` will be documented in this file.
 
 This file is generated from conventional commits by the
-https://github.com/hyperpolymath/standards/blob/main/.github/workflows/changelog-reusable.yml[`+changelog-reusable.yml+`]
-workflow (`+hyperpolymath/standards#206+`). Adopt the workflow in this
+https://github.com/metadatastician/standards/blob/main/.github/workflows/changelog-reusable.yml[`+changelog-reusable.yml+`]
+workflow (`+metadatastician/standards#206+`). Adopt the workflow in this
 repo’s CI to keep this file in sync automatically — see
-https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+templates/cliff.toml+`]
+https://github.com/metadatastician/standards/blob/main/templates/cliff.toml[`+templates/cliff.toml+`]
 for the canonical config.
 
 The format follows https://keepachangelog.com/en/1.1.0/[Keep a
@@ -46,7 +46,7 @@ Comment-step gate) (#3)
 Prior commits to this file’s introduction are recorded in git history
 but not formally classified into Keep-a-Changelog sections. To backfill,
 run `+git cliff -o CHANGELOG.md+` locally using the canonical
-https://github.com/hyperpolymath/standards/blob/main/templates/cliff.toml[`+cliff.toml+`]
+https://github.com/metadatastician/standards/blob/main/templates/cliff.toml[`+cliff.toml+`]
 — this is one-shot mechanical work.
 
 '''''