diff --git a/README.md b/README.md
index 71250f637..c859821a5 100644
--- a/README.md
+++ b/README.md
@@ -131,4 +131,4 @@ For commercial inquiries, email [support@combsmith.com](mailto:support@combsmith
 
 ## Contributing
 
-See the org-wide [Contributing Guide](https://github.com/combsmith/.github/blob/main/CONTRIBUTING.md) and [SECURITY.md](SECURITY.md).
+See the org-wide [Contributing Guide](https://github.com/combsmith/.github/blob/main/CONTRIBUTING.md) and [Security Policy](https://github.com/combsmith/.github/blob/main/SECURITY.md).
diff --git a/SECURITY.md b/SECURITY.md
deleted file mode 100644
index 6556eda48..000000000
--- a/SECURITY.md
+++ /dev/null
@@ -1,26 +0,0 @@
-# Security Policy
-
-## Reporting a Vulnerability
-
-If you discover a security vulnerability in this repository, please report it
-**privately**. Do not open a public issue, pull request, or discussion, as that
-may expose the vulnerability before it can be addressed.
-
-Report a vulnerability through either of these channels:
-
-- **GitHub private vulnerability reporting** — use the repository's
-  **Security → Report a vulnerability** tab to open a private advisory.
-- **Email** — send details to donpetry@gmail.com with the subject line
-  **"SECURITY"**.
-
-Please include enough information to reproduce and assess the issue (affected
-component, steps to reproduce, and potential impact).
-
-## What to Expect
-
-- We will acknowledge your report within **5 business days**.
-- We will keep you informed as we investigate and work toward a fix.
-- Please give us a reasonable opportunity to remediate the issue before any
-  public disclosure.
-
-Thank you for helping keep this project and its users safe.
diff --git a/scripts/seed-repo-template.sh b/scripts/seed-repo-template.sh
index 4266b164d..bb672827c 100755
--- a/scripts/seed-repo-template.sh
+++ b/scripts/seed-repo-template.sh
@@ -22,7 +22,8 @@ set -euo pipefail
 # It also emits the root/baseline files (AC #3): AGENTS.md (consumer pointer),
 # CLAUDE.md (1-line pointer), .github/CODEOWNERS, .github/dependabot.yml (from the
 # chosen standards/dependabot/<stack>), sonar-project.properties, .gitignore,
-# LICENSE, SECURITY.md, README.md, BOOTSTRAP.md. No issue/PR templates and no
+# LICENSE, README.md, BOOTSTRAP.md (SECURITY.md is inherited org-wide from
+# combsmith/.github). No issue/PR templates and no
 # labeler config are introduced (AC #5). README.md's commercial-support section is
 # read from standards/commercial-support-standard.md at the resolved ref (#2233).
 #
@@ -170,7 +171,6 @@ readonly -a BASELINE_MANIFEST=(
   "sonar-project.properties|gen"
   ".gitignore|gen"
   "LICENSE|gen"
-  "SECURITY.md|gen"
   "README.md|gen"
   "BOOTSTRAP.md|gen"
 )
@@ -471,15 +471,6 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
-EOF
-      ;;
-    SECURITY.md) cat <<'EOF'
-# Security Policy
-
-To report a vulnerability, please follow the org-wide policy in
-[`combsmith/.github`](https://github.com/combsmith/.github/blob/main/SECURITY.md).
-
-Do not open public issues for security reports.
 EOF
       ;;
     README.md)
@@ -510,7 +501,7 @@ verification checks, and the short list of org-admin steps a human finishes.
 | CI (`build-and-test`, `Secret scan (gitleaks)`, `coverage`) and SonarCloud | `ci.yml`, `sonarcloud.yml` | Green out of the box; replace the shell steps with your stack's |
 | Copilot cloud-agent setup | `copilot-setup-steps.yml` | Uncomment your stack block |
 | Dependabot | `.github/dependabot.yml` | `frontend` stack by default; swap for yours |
-| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `SECURITY.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
+| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
 | Repo settings, rulesets, labels, GHAS | not files | Applied by `bootstrap-new-repo.sh` in `combsmith/.github` (org admin) |
 | Initiatives board (`add-to-project`) | stub only | Red until an org admin both grants the repo the `INITIATIVES_APP_*` org secrets (selected visibility) and adds it to the `combsmith-planner` app installation |
 
@@ -596,7 +587,7 @@ by PR, and the compliance audit flags any hand edit as drift):
 |---|---|
 | `.github/workflows/add-to-project.yml`, `agent-shield.yml`, `auto-rebase.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `dependency-audit.yml`, `dev-lead.yml`, `initiative-driver.yml`, `persona-mention.yml`, `pr-auto-review.yml`, `pr-review-mention.yml` | Thin caller stubs. Behaviour lives in the org reusables; the `uses:` pin is moved centrally. `agent-shield.yml` is additionally a security boundary agents must never modify. |
 | `.github/CODEOWNERS` | `* @combsmith/org-leads` must stay the first owner on every line. Add path lines only *after* it. |
-| `CLAUDE.md`, `SECURITY.md`, `LICENSE` | Org pointers and license. |
+| `CLAUDE.md`, `LICENSE` | Org pointer and license (`SECURITY.md` is inherited org-wide from `combsmith/.github`). |
 | `.gitignore` — the block between `>>> BEGIN combsmith secrets baseline` and `<<< END` | Hash-checked by the compliance audit. Edit only **below** the END marker. |
 | `.gitleaks.toml` | Keep the file; you may only **append** allowlist paths under `[allowlist]`. |
 | `.github/workflows/sonarcloud.yml` | Keep as shipped; the `SonarCloud` job name is a required check, and it derives `sonar.projectKey` / `sonar.organization` from the repo (`<owner>_<name>` / `<owner>`), so no per-repo key is needed. |
diff --git a/tests/fixtures/seed-repo-template/repo-template-BOOTSTRAP.md b/tests/fixtures/seed-repo-template/repo-template-BOOTSTRAP.md
index 18f424066..758298548 100644
--- a/tests/fixtures/seed-repo-template/repo-template-BOOTSTRAP.md
+++ b/tests/fixtures/seed-repo-template/repo-template-BOOTSTRAP.md
@@ -68,7 +68,7 @@ by PR, and the compliance audit flags any hand edit as drift):
 |---|---|
 | `.github/workflows/add-to-project.yml`, `agent-shield.yml`, `auto-rebase.yml`, `dependabot-automerge.yml`, `dependabot-rebase.yml`, `dependency-audit.yml`, `dev-lead.yml`, `initiative-driver.yml`, `persona-mention.yml`, `pr-auto-review.yml`, `pr-review-mention.yml` | Thin caller stubs. Behaviour lives in the org reusables; the `uses:` pin is moved centrally. `agent-shield.yml` is additionally a security boundary agents must never modify. |
 | `.github/CODEOWNERS` | `* @combsmith/org-leads` must stay the first owner on every line. Add path lines only *after* it. |
-| `CLAUDE.md`, `SECURITY.md`, `LICENSE` | Org pointers and license. |
+| `CLAUDE.md`, `LICENSE` | Org pointer and license (`SECURITY.md` is inherited org-wide from `combsmith/.github`). |
 | `.gitignore` — the block between `>>> BEGIN combsmith secrets baseline` and `<<< END` | Hash-checked by the compliance audit. Edit only **below** the END marker. |
 | `.gitleaks.toml` | Keep the file; you may only **append** allowlist paths under `[allowlist]`. |
 | `.github/workflows/sonarcloud.yml` | Keep as shipped; the `SonarCloud` job name is a required check, and it derives `sonar.projectKey` / `sonar.organization` from the repo (`<owner>_<name>` / `<owner>`), so no per-repo key is needed. |
diff --git a/tests/fixtures/seed-repo-template/repo-template-README.md b/tests/fixtures/seed-repo-template/repo-template-README.md
index a6b17a8c3..de0e2dfbe 100644
--- a/tests/fixtures/seed-repo-template/repo-template-README.md
+++ b/tests/fixtures/seed-repo-template/repo-template-README.md
@@ -20,7 +20,7 @@ verification checks, and the short list of org-admin steps a human finishes.
 | CI (`build-and-test`, `Secret scan (gitleaks)`, `coverage`) and SonarCloud | `ci.yml`, `sonarcloud.yml` | Green out of the box; replace the shell steps with your stack's |
 | Copilot cloud-agent setup | `copilot-setup-steps.yml` | Uncomment your stack block |
 | Dependabot | `.github/dependabot.yml` | `frontend` stack by default; swap for yours |
-| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `SECURITY.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
+| Baseline files | `CODEOWNERS`, `AGENTS.md`, `CLAUDE.md`, `LICENSE`, `.gitignore` (secrets baseline), `.gitleaks.toml`, `sonar-project.properties`, `copilot-instructions.md` | Docs need the project's name; the Sonar key is derived from the repo by `sonarcloud.yml` |
 | Repo settings, rulesets, labels, GHAS | not files | Applied by `bootstrap-new-repo.sh` in `combsmith/.github` (org admin) |
 | Initiatives board (`add-to-project`) | stub only | Red until an org admin both grants the repo the `INITIATIVES_APP_*` org secrets (selected visibility) and adds it to the `combsmith-planner` app installation |
 
diff --git a/tests/test_seed_repo_template.bats b/tests/test_seed_repo_template.bats
index 4ee21dce1..475ddcde1 100644
--- a/tests/test_seed_repo_template.bats
+++ b/tests/test_seed_repo_template.bats
@@ -219,14 +219,15 @@ EOF
 }
 
 # ── manifest: baseline set (AC #3) ────────────────────────────────────────────
-@test "list-baseline: includes every required root/baseline file" {
+@test "list-baseline: includes every required root/baseline file and omits SECURITY.md (inherited org-wide)" {
   run bash "$SEED" --list-baseline
   [ "$status" -eq 0 ]
   for f in AGENTS.md CLAUDE.md .github/CODEOWNERS .github/dependabot.yml \
            .gitleaks.toml sonar-project.properties .gitignore LICENSE \
-           SECURITY.md README.md BOOTSTRAP.md; do
+           README.md BOOTSTRAP.md; do
     [[ "$output" == *"$f"* ]] || { echo "missing baseline: $f" >&2; false; }
   done
+  [[ "$output" != *"SECURITY.md"* ]]
 }
 
 # ── repin: caller stubs → published major-scoped channel tags (AC #1, #2) ──────
@@ -909,8 +910,8 @@ GHEOF
 SEED_FIXTURES="$SCRIPT_DIR/tests/fixtures/seed-repo-template"
 # Git blob SHAs of those two repo-template files (guards the fixtures themselves
 # against an editor/hook adding a trailing newline).
-REPO_TEMPLATE_README_BLOB=a6b17a8c32f6181248e55a17f9254bb0480f0f3d
-REPO_TEMPLATE_BOOTSTRAP_BLOB=18f42406609dcb019362fc012c2ffc70b5c8de43
+REPO_TEMPLATE_README_BLOB=de0e2dfbed19a3391a0b2fcddf3a22ebad6e809e
+REPO_TEMPLATE_BOOTSTRAP_BLOB=758298548cb22893267585aea9ad4803beacf641
 REPO_TEMPLATE_AGENTS_BLOB=1c5e6cb3b131037b7a103ebf33c243fac9facd0c
 
 _fixture_commercial_standard() {