diff --git a/.github/workflows/repo-benchmarks.yml b/.github/workflows/repo-benchmarks.yml
index 2863b53..4379c8c 100644
--- a/.github/workflows/repo-benchmarks.yml
+++ b/.github/workflows/repo-benchmarks.yml
@@ -23,7 +23,7 @@ jobs:
     # dormant until setup is complete and excludes pull requests from forks.
     # Caller code runs without credentials; a separate fresh runner publishes.
     if: vars.BENCHER_PROJECT != '' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-    uses: zemd/js/.github/workflows/shared-benchmarks.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-benchmarks.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout the repository for benchmarks
       checks: write # used only by the isolated Bencher publishing job
diff --git a/.github/workflows/repo-ci.yml b/.github/workflows/repo-ci.yml
index 6f291a4..8b6d84a 100644
--- a/.github/workflows/repo-ci.yml
+++ b/.github/workflows/repo-ci.yml
@@ -14,7 +14,7 @@ concurrency:
 jobs:
   ci:
     name: CI
-    uses: zemd/js/.github/workflows/shared-ci.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-ci.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read
     # Every input is optional. Node.js is fixed to lts/*, dependency review
diff --git a/.github/workflows/repo-codeql.yml b/.github/workflows/repo-codeql.yml
index 13de0e8..52ff1e5 100644
--- a/.github/workflows/repo-codeql.yml
+++ b/.github/workflows/repo-codeql.yml
@@ -20,7 +20,7 @@ concurrency:
 jobs:
   codeql:
     name: CodeQL
-    uses: zemd/js/.github/workflows/shared-codeql.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-codeql.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout the repository for analysis
       actions: read # let CodeQL read workflow-run metadata
diff --git a/.github/workflows/repo-release.yml b/.github/workflows/repo-release.yml
index 81ee9d3..a9f4c87 100644
--- a/.github/workflows/repo-release.yml
+++ b/.github/workflows/repo-release.yml
@@ -18,7 +18,7 @@ concurrency:
 jobs:
   release:
     name: Release
-    uses: zemd/js/.github/workflows/shared-release.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-release.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     # Node.js lts/*, main, release/main, the release PR title, npmjs.org, and
     # the `build` and `lint-publish` scripts are fixed shared conventions.
     permissions:
diff --git a/.github/workflows/repo-scorecard.yml b/.github/workflows/repo-scorecard.yml
index 7979d97..1acf09e 100644
--- a/.github/workflows/repo-scorecard.yml
+++ b/.github/workflows/repo-scorecard.yml
@@ -17,7 +17,7 @@ concurrency:
 jobs:
   scorecard:
     name: Scorecard
-    uses: zemd/js/.github/workflows/shared-scorecard.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-scorecard.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout the repository for analysis
       actions: read # inspect workflow runs for dangerous patterns
diff --git a/.github/workflows/repo-zizmor.yml b/.github/workflows/repo-zizmor.yml
index ca9c829..57bca9e 100644
--- a/.github/workflows/repo-zizmor.yml
+++ b/.github/workflows/repo-zizmor.yml
@@ -21,7 +21,7 @@ concurrency:
 jobs:
   zizmor:
     name: zizmor
-    uses: zemd/js/.github/workflows/shared-zizmor.yml@e61d8c10a67016e8788b793388ef748ac80b4d35 # v4
+    uses: zemd/js/.github/workflows/shared-zizmor.yml@fb41af590e525c7846a8dce0286fa69ac89171f7 # v4
     permissions:
       contents: read # checkout and online audits
     # with: