diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index 60c630b..1978208 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -33,12 +33,6 @@ workflows:
         - 'actions/checkout@v7.0.1'
     '.github/workflows/runtime-policy.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/scorecard-enforcer.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'actions/download-artifact@v8.0.2'
-        - 'actions/upload-artifact@v7.0.2'
-        - 'github/codeql-action@v4.38.3'
-        - 'ossf/scorecard-action@v2.5.0'
     '.github/workflows/scorecard.yml': []
     '.github/workflows/secret-scanner.yml': []
     '.github/workflows/security-policy.yml':
@@ -61,21 +55,11 @@ dependencies:
         commit: 'sha1-368f82528645a54fb793d4d04e342629a3f51346'
         owner_id: 44036562
         repo_id: 438112499
-    'actions/download-artifact@v8.0.2':
-        ref: 'v8.0.2'
-        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
-        owner_id: 44036562
-        repo_id: 192626254
     'actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f':
         ref: 'v7.0.0'
         commit: 'sha1-bbbca2ddaa5d8feaa63e36b76fdaad77386f024f'
         owner_id: 44036562
         repo_id: 192625955
-    'actions/upload-artifact@v7.0.2':
-        ref: 'v7.0.2'
-        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
-        owner_id: 44036562
-        repo_id: 192625955
     'actions/upload-pages-artifact@v5.0.0':
         ref: 'v5.0.0'
         commit: 'sha1-fc324d3547104276b827a68afc52ff2a11cc49c9'
@@ -103,11 +87,6 @@ dependencies:
         commit: 'sha1-00cae500b08a931fb5698e11e79bfbd38e612a38'
         owner_id: 15093472
         repo_id: 174679242
-    'ossf/scorecard-action@v2.5.0':
-        ref: 'v2.5.0'
-        commit: 'sha1-fa7117db83c52d787ae5a89f350999701505d78e'
-        owner_id: 67707773
-        repo_id: 421101922
     'peter-evans/repository-dispatch@v4.0.1':
         ref: 'v4.0.1'
         commit: 'sha1-28959ce8df70de7be546dd1250a005dd32156697'
diff --git a/.github/workflows/scorecard-enforcer.yml b/.github/workflows/scorecard-enforcer.yml
deleted file mode 100644
index 30135b9..0000000
--- a/.github/workflows/scorecard-enforcer.yml
+++ /dev/null
@@ -1,111 +0,0 @@
-# This workflow is managed by gh actions-lock.
-# SPDX-License-Identifier: MPL-2.0
-# This workflow is managed by gh actions-lock.
-# Prevention workflow - runs OpenSSF Scorecard and fails on low scores
-name: OpenSSF Scorecard Enforcer
-
-on:
-  push:
-    branches: [main]
-  schedule:
-    - cron: '0 6 * * 1'  # Weekly on Monday
-  workflow_dispatch:
-
-# Estate guardrail: cancel superseded runs so re-pushes / rebased PR
-# updates do not pile up queued runs against the shared account-wide
-# Actions concurrency pool. Applied only to read-only check workflows
-# (no publish/mutation), so cancelling a superseded run is always safe.
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions:
-  actions: read
-  contents: read
-
-jobs:
-  # The OSSF Scorecard publish endpoint enforces a hard contract: the job that
-  # runs `ossf/scorecard-action` with `publish_results: true` must contain
-  # ONLY steps with `uses:` (no `run:` steps in the same job). If a `run:`
-  # step is present, the publish step fails with:
-  #   "webapp: scorecard job must only have steps with uses"
-  # (49 estate repos hit this; see ROADMAP audit 2026-05-30.)
-  #
-  # Fix: split the threshold check into a downstream job that depends on
-  # `scorecard` and consumes the SARIF artifact. The `scorecard` job stays
-  # uses-only; `check-score` is the gating job that emits the error.
-  scorecard:
-    runs-on: ubuntu-latest
-    permissions:
-      security-events: write
-      id-token: write  # For OIDC
-    steps:
-      - uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-
-      - name: Run Scorecard
-        uses: ossf/scorecard-action@v2.5.0
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          publish_results: true
-
-      - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@v4.38.3
-        with:
-          sarif_file: results.sarif
-
-      - name: Persist SARIF for downstream score-gate job
-        uses: actions/upload-artifact@v7.0.2
-        with:
-          name: scorecard-results
-          path: results.sarif
-          retention-days: 1
-
-  check-score:
-    needs: scorecard
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Download SARIF from scorecard job
-        uses: actions/download-artifact@v8.0.2
-        with:
-          name: scorecard-results
-
-      - name: Check minimum score
-        run: |
-          SCORE=$(jq -r '.runs[0].tool.driver.properties.score // 0' results.sarif 2>/dev/null || echo "0")
-
-          echo "OpenSSF Scorecard Score: $SCORE"
-
-          # Minimum acceptable score (0-10 scale)
-          MIN_SCORE=5
-
-          if [ "$(echo "$SCORE < $MIN_SCORE" | bc -l)" = "1" ]; then
-            echo "::error::Scorecard score $SCORE is below minimum $MIN_SCORE"
-            exit 1
-          fi
-
-  # Check specific high-priority items
-  check-critical:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v7.0.1
-
-      - name: Check SECURITY.md exists
-        run: |
-          if [ ! -f "SECURITY.md" ]; then
-            echo "::error::SECURITY.md is required"
-            exit 1
-          fi
-
-      - name: Check for pinned dependencies
-        run: |
-          # Check workflows for unpinned actions
-          unpinned=$(grep -r "uses:.*@v[0-9]" .github/workflows/*.yml 2>/dev/null | grep -v "#" | head -5 || true)
-          if [ -n "$unpinned" ]; then
-            echo "::warning::Found unpinned actions:"
-            echo "$unpinned"
-          fi