diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6a0f1b7..ae27f48 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -27,14 +27,6 @@ updates:
   # "security only, not routine bumps". Pair with the
   # dependabot-automerge.yml workflow for low-touch security
   # maintenance.
-    ignore:
-      # HOLD: github/codeql-action at v4.38.0 (commit b96794f0, held by
-      # .github/workflows/actions.lock). v4.38.1 fails
-      # GitHub workflow-startup validation estate-wide (nexia-list#100;
-      # SHA-form re-bump bypassed versions-scoped ignores - see
-      # nexia-list#101/#104). Hold until upstream clears 4.38.1 or a
-      # newer release verifies green; revisit deliberately.
-      - dependency-name: "github/codeql-action"
 
   - package-ecosystem: "cargo"
     directory: "/"
diff --git a/.github/workflows/README.adoc b/.github/workflows/README.adoc
index c7a2328..5f3adda 100644
--- a/.github/workflows/README.adoc
+++ b/.github/workflows/README.adoc
@@ -55,7 +55,7 @@ pins), and gitleaks in CI catches a genuine SonarCloud token as `generic-api-key
 
 == SAST tools are complementary, not redundant
 
-* `codeql.yml` — CodeQL (matrix defaults to `actions`; every repo has workflows).
+* CodeQL — GitHub's default setup (repository settings), not a workflow file here.
 * `sonarqube.yml` — SonarCloud (shell / JS surface; see `sonar-project.properties`).
 * `static-analysis-gate.yml` — panic-attack + Hypatia gate (see above).
 
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
index b12aecc..09ce24e 100644
--- a/.github/workflows/actions.lock
+++ b/.github/workflows/actions.lock
@@ -5,9 +5,6 @@ version: 'v0.0.2'
 workflows:
     '.github/workflows/build-notification.yml':
         - 'actions/checkout@v7.0.1'
-    '.github/workflows/codeql.yml':
-        - 'actions/checkout@v7.0.1'
-        - 'github/codeql-action@v4.38.0'
     '.github/workflows/deed-validate.yml':
         - 'actions/checkout@v7.0.1'
         - 'hyperpolymath/deed-ecosystem@main'
@@ -200,11 +197,6 @@ dependencies:
         commit: 'sha1-cdf488f595d80d6e07e03d4674febd5ab45fa938'
         owner_id: 9919
         repo_id: 259445878
-    'github/codeql-action@v4.38.0':
-        ref: 'v4.38.0'
-        commit: 'sha1-b96794f015dfd88f77b49b1c93e0fa7110f94c63'
-        owner_id: 9919
-        repo_id: 259445878
     'goto-bus-stop/setup-zig@abea47f85e598557f500fa1fd2ab7464fcb39406':
         ref: 'abea47f85e598557f500fa1fd2ab7464fcb39406'
         commit: 'sha1-abea47f85e598557f500fa1fd2ab7464fcb39406'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 3e92dc1..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,47 +0,0 @@
-# This workflow is managed by gh actions-lock.
-# SPDX-License-Identifier: MPL-2.0
-name: CodeQL Security Analysis
-on:
-  push:
-    branches: [main, master]
-  pull_request:
-    branches: [main, master]
-  schedule:
-    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC (Actions burn cut, standards#288)
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-permissions:
-  contents: read
-jobs:
-  analyze:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-      security-events: write
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          # Default to `actions` — scaffolded repos rarely have JS/TS
-          # failures on every CodeQL run. The `actions` extractor scans
-          # workflow files which every repo has. Override per-repo if
-          # the scaffolded project actually contains JS/TS code.
-          # Per hypatia rule `codeql_language_matrix_mismatch`.
-          - language: actions
-            build-mode: none
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7.0.1
-        with:
-          persist-credentials: false
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.38.0 # b96794f0 in actions.lock (4.38.1 blocked estate-wide; nexia-list#100)
-        with:
-          languages: ${{ matrix.language }}
-          build-mode: ${{ matrix.build-mode }}
-      - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.38.0 # b96794f0 in actions.lock (4.38.1 blocked estate-wide; nexia-list#100)
-        with:
-          category: "/language:${{ matrix.language }}"