diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml
new file mode 100644
index 00000000..9b8867d0
--- /dev/null
+++ b/.github/workflows/zz-one-off-lock-regen.yml
@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: MPL-2.0
+# ONE-OFF, scratch branch only, deleted after use. Regenerates main's
+# actions.lock with the estate repair order (regen_lock in
+# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own
+# check against the result, and prints the lock base64-encoded. It has no
+# `uses:` steps, so it needs no lock entry to start. It writes nothing back:
+# the lock reaches the repository in a reviewed PR.
+name: one-off actions.lock regeneration
+on:
+  push:
+    branches: [claude/new-session-th4e9w-lockregen]
+permissions:
+  contents: read
+jobs:
+  regen:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: ${{ github.repository }}
+      STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
+      STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
+    steps:
+      - name: Regenerate the repair branch's actions.lock and check it with the gate
+        run: |
+          set -uo pipefail
+          git clone --quiet --branch claude/new-session-th4e9w-lock-repair "https://github.com/$REPO.git" pb
+          git -C pb log --oneline -1
+          git clone --quiet https://github.com/hyperpolymath/standards.git std
+          git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA"
+          git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA"
+          sudo apt-get install -y -qq gawk >/dev/null
+          gh extension install github/gh-actions-lock --pin v0.2.0
+          gh actions-lock --version
+          # The repair chain without a gh actions-lock fix-mode pass (it drops
+          # records it cannot re-resolve).
+          export GH_BIN=gh
+          for s in relock-sha-keys complete-job-refs close-lock prune-stale check-lock-sync; do
+            (cd pb && bash ../std-regen/scripts/$s.sh .github/workflows; echo "$s RC=$?")
+          done
+          git -C pb status --porcelain
+          echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)"
+          (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \
+            bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?"
+          echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)"
+          echo "DIFF-BEGIN"
+          git -C pb diff -- .github/workflows/actions.lock
+          echo "DIFF-END"