diff --git a/.github/workflows/pr-verifier.yml b/.github/workflows/pr-verifier.yml
index e2bfc8b..8a6e377 100644
--- a/.github/workflows/pr-verifier.yml
+++ b/.github/workflows/pr-verifier.yml
@@ -8,4 +8,4 @@ permissions: {}
 
 jobs:
   verify-pr-title:
-    uses: kagenti/.github/.github/workflows/pr-verifier-required.yml@4e535f2436d167295d39d488ce5c44b5a2d49792
+    uses: rossoctl/.github/.github/workflows/pr-verifier-required.yml@89bd5f961c3a91253d4bb54de69faff47397abcd # 2026-07-21
diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml
index f6f4f4e..2f74938 100644
--- a/.github/workflows/project.yml
+++ b/.github/workflows/project.yml
@@ -18,7 +18,7 @@ jobs:
       pull-requests: write
       contents: read
 
-    # Pinned to @main intentionally: org-internal workflows propagate updates automatically.
-    uses: kagenti/.github/.github/workflows/add-to-project.yml@main
+    # SHA-pinned to a specific rossoctl/.github commit (not @main) for supply-chain safety.
+    uses: rossoctl/.github/.github/workflows/add-to-project.yml@2610c7817f0acb847f83038fe7c4718112cf94d8 # 2026-07-20
     secrets: inherit
 
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index b317f8c..aafdf22 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -18,4 +18,4 @@ permissions:
 
 jobs:
   stale:
-    uses: kagenti/.github/.github/workflows/stale.yaml@main
+    uses: rossoctl/.github/.github/workflows/stale.yaml@89bd5f961c3a91253d4bb54de69faff47397abcd # 2026-07-21