diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27e7bdd..26a3211 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
     name: rust
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-ci.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       # Two, not three. Windows is absent because nothing here is built for it:
       # the deliverable is a Linux container, and macOS is kept because it is
@@ -65,7 +65,7 @@ jobs:
     name: supply-chain
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/rust-supply-chain.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       enable_audit: true
       # cargo-deny and cargo-machete are off deliberately, not by omission.
@@ -81,7 +81,7 @@ jobs:
     name: actionlint
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/actionlint.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
 
   pr-hygiene:
     name: pr-hygiene
@@ -90,7 +90,7 @@ jobs:
       contents: read
       issues: write # the stale bot closes threads
       pull-requests: write # the labeler applies labels
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/pr-hygiene.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       # The stock configuration rejects any body line over 100 characters, and
       # Dependabot writes a 144-character compare link into every git-ref bump.
diff --git a/.github/workflows/image.yml b/.github/workflows/image.yml
index 8472de7..f23a580 100644
--- a/.github/workflows/image.yml
+++ b/.github/workflows/image.yml
@@ -70,7 +70,7 @@ jobs:
     permissions:
       contents: read
       packages: write # ghcr.io push and the registry layer cache
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/docker-build.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       image: ghcr.io/nddev-opennetwork/nremote-server
       tags: ${{ needs.plan.outputs.tags }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 4ecef74..6daeb54 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -26,7 +26,7 @@ jobs:
       actions: read # CodeQL reads the workflow definitions it analyses
       contents: read
       security-events: write # CodeQL publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       languages: '["rust", "actions"]'
       queries: security-and-quality
@@ -40,7 +40,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: write # writes the review it produces
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-dependency-review.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       fail_on_severity: moderate
 
@@ -52,13 +52,13 @@ jobs:
       contents: read
       id-token: write # mints the OIDC token its publication is signed with
       security-events: write # Scorecard publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-scorecard.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
 
   osv:
     name: osv
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@1ab6708b62ec7bd17f2d8a519c6fcc39edb22243
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/osv-scan.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
 
   zizmor:
     name: zizmor
@@ -66,10 +66,10 @@ jobs:
       actions: read # the SARIF upload reads this run to attach its results
       contents: read
       security-events: write # zizmor publishes its findings to code scanning
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/zizmor-sarif.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
 
   secret-scan:
     name: secret-scan
     permissions:
       contents: read
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@9231ee7421354867b0fe0e019c4e20dcce5d05e7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/secret-scan.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23