diff --git a/.github/workflows/repo-benchmarks.yml b/.github/workflows/repo-benchmarks.yml
index 4379c8c..8e18d8a 100644
--- a/.github/workflows/repo-benchmarks.yml
+++ b/.github/workflows/repo-benchmarks.yml
@@ -23,7 +23,7 @@ jobs:
     # dormant until setup is complete and excludes pull requests from forks.
     # Caller code runs without credentials; a separate fresh runner publishes.
     if: vars.BENCHER_PROJECT != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-    uses: zemd/js/.github/workflows/shared-benchmarks.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
+    uses: zemd/js/.github/workflows/shared-benchmarks.yml@802d24c5b50e0863a43133d634e78cdc4a7eb99c # v4
     permissions:
       contents: read # checkout the repository for benchmarks
       checks: write # used only by the isolated Bencher publishing job
diff --git a/.github/workflows/repo-ci.yml b/.github/workflows/repo-ci.yml
index 8b6d84a..0f390bf 100644
--- a/.github/workflows/repo-ci.yml
+++ b/.github/workflows/repo-ci.yml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   ci:
     name: CI
-    uses: zemd/js/.github/workflows/shared-ci.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
+    uses: zemd/js/.github/workflows/shared-ci.yml@802d24c5b50e0863a43133d634e78cdc4a7eb99c # v4
     permissions:
       contents: read
     # Every input is optional. Node.js is fixed to lts/*, dependency review
diff --git a/.github/workflows/repo-codeql.yml b/.github/workflows/repo-codeql.yml
index 52ff1e5..893e0ec 100644
--- a/.github/workflows/repo-codeql.yml
+++ b/.github/workflows/repo-codeql.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   codeql:
     name: CodeQL
-    uses: zemd/js/.github/workflows/shared-codeql.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
+    uses: zemd/js/.github/workflows/shared-codeql.yml@802d24c5b50e0863a43133d634e78cdc4a7eb99c # v4
     permissions:
       contents: read # checkout the repository for analysis
       actions: read # let CodeQL read workflow-run metadata
diff --git a/.github/workflows/repo-release.yml b/.github/workflows/repo-release.yml
index a9f4c87..2a34dd8 100644
--- a/.github/workflows/repo-release.yml
+++ b/.github/workflows/repo-release.yml
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   release:
     name: Release
-    uses: zemd/js/.github/workflows/shared-release.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
+    uses: zemd/js/.github/workflows/shared-release.yml@802d24c5b50e0863a43133d634e78cdc4a7eb99c # v4
     # Node.js lts/*, main, release/main, the release PR title, npmjs.org, and
     # the `build` and `lint-publish` scripts are fixed shared conventions.
     permissions:
diff --git a/.github/workflows/repo-scorecard.yml b/.github/workflows/repo-scorecard.yml
index 1acf09e..065b4d9 100644
--- a/.github/workflows/repo-scorecard.yml
+++ b/.github/workflows/repo-scorecard.yml
@@ -17,7 +17,7 @@ concurrency:
 jobs:
   scorecard:
     name: Scorecard
-    uses: zemd/js/.github/workflows/shared-scorecard.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
+    uses: zemd/js/.github/workflows/shared-scorecard.yml@802d24c5b50e0863a43133d634e78cdc4a7eb99c # v4
     permissions:
       contents: read # checkout the repository for analysis
       actions: read # inspect workflow runs for dangerous patterns
diff --git a/.github/workflows/repo-zizmor.yml b/.github/workflows/repo-zizmor.yml
index 57bca9e..29aef6d 100644
--- a/.github/workflows/repo-zizmor.yml
+++ b/.github/workflows/repo-zizmor.yml
@@ -21,7 +21,7 @@ concurrency:
 jobs:
   zizmor:
     name: zizmor
-    uses: zemd/js/.github/workflows/shared-zizmor.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
+    uses: zemd/js/.github/workflows/shared-zizmor.yml@802d24c5b50e0863a43133d634e78cdc4a7eb99c # v4
     permissions:
       contents: read # checkout and online audits
     # with: