diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 221176c..c90a324 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   audit:
-    uses: Glyndor/.github/.github/workflows/go-audit.yml@7099f8a9c8be91fa1732fe2402268b338771233f # v1.10.1
+    uses: Glyndor/.github/.github/workflows/go-audit.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
     with:
       # G104 (errcheck on logger Output) and G306 (public-key 0644) are justified
       # in code with //nolint:gosec; standalone gosec ignores those pragmas.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a45863c..3bf26dc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   go:
-    uses: Glyndor/.github/.github/workflows/go-ci.yml@045903bf83a58651f119bc7d952aa45242b897c5
+    uses: Glyndor/.github/.github/workflows/go-ci.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
     with:
       coverage-threshold: 90
       # Every package clears this today, which is exactly when a floor is
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index 9960437..deb177c 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -11,4 +11,4 @@ permissions:
 
 jobs:
   dco:
-    uses: Glyndor/.github/.github/workflows/dco.yml@7099f8a9c8be91fa1732fe2402268b338771233f # v1.10.1
+    uses: Glyndor/.github/.github/workflows/dco.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 67202f1..de18afc 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -10,7 +10,7 @@ permissions:
 
 jobs:
   fuzz:
-    uses: Glyndor/.github/.github/workflows/go-fuzz.yml@045903bf83a58651f119bc7d952aa45242b897c5
+    uses: Glyndor/.github/.github/workflows/go-fuzz.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
     with:
       fuzztime: "60s"
       targets: >-
diff --git a/.github/workflows/line-limit.yml b/.github/workflows/line-limit.yml
index de42ae2..c3a1f60 100644
--- a/.github/workflows/line-limit.yml
+++ b/.github/workflows/line-limit.yml
@@ -11,4 +11,4 @@ permissions:
 
 jobs:
   line-limit:
-    uses: Glyndor/.github/.github/workflows/line-limit.yml@7099f8a9c8be91fa1732fe2402268b338771233f # v1.10.1
+    uses: Glyndor/.github/.github/workflows/line-limit.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
diff --git a/.github/workflows/main-guard.yml b/.github/workflows/main-guard.yml
index e96f3b4..3e6ad87 100644
--- a/.github/workflows/main-guard.yml
+++ b/.github/workflows/main-guard.yml
@@ -8,4 +8,4 @@ permissions: {}
 
 jobs:
   develop-only:
-    uses: Glyndor/.github/.github/workflows/main-guard.yml@7099f8a9c8be91fa1732fe2402268b338771233f # v1.10.1
+    uses: Glyndor/.github/.github/workflows/main-guard.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
diff --git a/.github/workflows/schedule-freshness.yml b/.github/workflows/schedule-freshness.yml
index 734e2ed..8ff5e23 100644
--- a/.github/workflows/schedule-freshness.yml
+++ b/.github/workflows/schedule-freshness.yml
@@ -25,14 +25,14 @@ permissions:
 jobs:
   audit:
     name: audit freshness
-    uses: Glyndor/.github/.github/workflows/schedule-freshness.yml@41d31f18d3ed3bb1a8cbbc44c68030e4867488b2 # v1.11.0
+    uses: Glyndor/.github/.github/workflows/schedule-freshness.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
     with:
       workflow: audit.yml
       max-age-days: 15 # weekly cron, so two periods of slack
 
   fuzz:
     name: fuzz freshness
-    uses: Glyndor/.github/.github/workflows/schedule-freshness.yml@41d31f18d3ed3bb1a8cbbc44c68030e4867488b2 # v1.11.0
+    uses: Glyndor/.github/.github/workflows/schedule-freshness.yml@045903bf83a58651f119bc7d952aa45242b897c5 # v1.12.0
     with:
       workflow: fuzz.yml
       max-age-days: 15 # weekly cron, so two periods of slack