diff --git a/.github/workflows/governance.yml b/.github/workflows/governance.yml
index b587d669..a04c0675 100644
--- a/.github/workflows/governance.yml
+++ b/.github/workflows/governance.yml
@@ -17,6 +17,12 @@ permissions:
 jobs:
   governance:
     uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
+    # Scanner pin, overriding the reusable's default (51ab649, which rejects the
+    # v0.0.3 actions.lock that gh actions-lock now writes). aa34a4c carries
+    # #938. Same value as standards#1315; drop this input once the `uses:` above
+    # is re-pinned past that PR.
+    with:
+      hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/hypatia-scan.yml b/.github/workflows/hypatia-scan.yml
index c640d0f7..f647bbcc 100644
--- a/.github/workflows/hypatia-scan.yml
+++ b/.github/workflows/hypatia-scan.yml
@@ -22,5 +22,8 @@ permissions:
 jobs:
   hypatia:
     uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@333b06a01db1874ffedb2de1bfabb195640927c7
+    # Scanner pin: see governance.yml. Drop once `uses:` is re-pinned.
+    with:
+      hypatia-ref: aa34a4cc6ba39d873710ff39763fdb9cde715f9d
     secrets:
       HYPATIA_SCAN_PAT: ${{ secrets.HYPATIA_SCAN_PAT }}