diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 9ee3804..5f4c294 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -3,8 +3,10 @@
 # Calls the estate's shared secret scanner (gitleaks + rust-secrets +
 # shell-secrets). Added because this repository had NO leak scanning at all.
 #
-# `secrets: inherit` is REQUIRED — without it the gitleaks action's inner
-# secrets.GITHUB_TOKEN is empty and the scan silently degrades.
+# No `secrets:` line: the reusable workflow (standards@75bd5994) declares no
+# secrets and reads none. Its gitleaks is a pinned local binary, and the
+# GITHUB_TOKEN its jobs run under is governed by `permissions:`, not by secret
+# passing. `secrets: inherit` would forward every repository secret for nothing.
 name: "Secret Scanner"
 on:
   pull_request:
@@ -18,4 +20,3 @@ permissions:
 jobs:
   scan:
     uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@75bd5994470661a099df562d6d5ad2fe744dbd66
-    secrets: inherit