diff --git a/actions/validate/.github/workflows/codeql.yml b/actions/validate/.github/workflows/codeql.yml
index de07c8f..e6bdb0e 100644
--- a/actions/validate/.github/workflows/codeql.yml
+++ b/actions/validate/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ permissions:
 
 jobs:
   analyze-js:
-    uses: ../../../.github/workflows/codeql-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     with:
       language: javascript-typescript
diff --git a/actions/validate/.github/workflows/governance.yml b/actions/validate/.github/workflows/governance.yml
index f5f282c..bd68b4c 100644
--- a/actions/validate/.github/workflows/governance.yml
+++ b/actions/validate/.github/workflows/governance.yml
@@ -24,4 +24,7 @@ permissions:
 
 jobs:
   governance:
-    uses: ../../../.github/workflows/governance-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/actions/validate/.github/workflows/hypatia-scan.yml b/actions/validate/.github/workflows/hypatia-scan.yml
index f120579..fbd8812 100644
--- a/actions/validate/.github/workflows/hypatia-scan.yml
+++ b/actions/validate/.github/workflows/hypatia-scan.yml
@@ -17,5 +17,9 @@ permissions:
 
 jobs:
   scan:
-    uses: ../../../.github/workflows/hypatia-scan-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/actions/validate/.github/workflows/mirror.yml b/actions/validate/.github/workflows/mirror.yml
index a20ae7d..639988a 100644
--- a/actions/validate/.github/workflows/mirror.yml
+++ b/actions/validate/.github/workflows/mirror.yml
@@ -11,5 +11,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: ../../../.github/workflows/mirror-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/actions/validate/.github/workflows/scorecard-enforcer.yml b/actions/validate/.github/workflows/scorecard-enforcer.yml
index bbba795..57bcadd 100644
--- a/actions/validate/.github/workflows/scorecard-enforcer.yml
+++ b/actions/validate/.github/workflows/scorecard-enforcer.yml
@@ -14,4 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/actions/validate/.github/workflows/scorecard.yml b/actions/validate/.github/workflows/scorecard.yml
index d665a83..31924ff 100644
--- a/actions/validate/.github/workflows/scorecard.yml
+++ b/actions/validate/.github/workflows/scorecard.yml
@@ -20,5 +20,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/actions/validate/.github/workflows/secret-scanner.yml b/actions/validate/.github/workflows/secret-scanner.yml
index 82b3c70..682b409 100644
--- a/actions/validate/.github/workflows/secret-scanner.yml
+++ b/actions/validate/.github/workflows/secret-scanner.yml
@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: ../../../.github/workflows/secret-scanner-reusable.yml
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/deno/.github/workflows/codeql.yml b/bindings/deno/.github/workflows/codeql.yml
index de07c8f..e6bdb0e 100644
--- a/bindings/deno/.github/workflows/codeql.yml
+++ b/bindings/deno/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ permissions:
 
 jobs:
   analyze-js:
-    uses: ../../../.github/workflows/codeql-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     with:
       language: javascript-typescript
diff --git a/bindings/deno/.github/workflows/governance.yml b/bindings/deno/.github/workflows/governance.yml
index f5f282c..bd68b4c 100644
--- a/bindings/deno/.github/workflows/governance.yml
+++ b/bindings/deno/.github/workflows/governance.yml
@@ -24,4 +24,7 @@ permissions:
 
 jobs:
   governance:
-    uses: ../../../.github/workflows/governance-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/bindings/deno/.github/workflows/hypatia-scan.yml b/bindings/deno/.github/workflows/hypatia-scan.yml
index f120579..fbd8812 100644
--- a/bindings/deno/.github/workflows/hypatia-scan.yml
+++ b/bindings/deno/.github/workflows/hypatia-scan.yml
@@ -17,5 +17,9 @@ permissions:
 
 jobs:
   scan:
-    uses: ../../../.github/workflows/hypatia-scan-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/deno/.github/workflows/mirror.yml b/bindings/deno/.github/workflows/mirror.yml
index a20ae7d..639988a 100644
--- a/bindings/deno/.github/workflows/mirror.yml
+++ b/bindings/deno/.github/workflows/mirror.yml
@@ -11,5 +11,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: ../../../.github/workflows/mirror-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/deno/.github/workflows/scorecard-enforcer.yml b/bindings/deno/.github/workflows/scorecard-enforcer.yml
index bbba795..57bcadd 100644
--- a/bindings/deno/.github/workflows/scorecard-enforcer.yml
+++ b/bindings/deno/.github/workflows/scorecard-enforcer.yml
@@ -14,4 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/bindings/deno/.github/workflows/scorecard.yml b/bindings/deno/.github/workflows/scorecard.yml
index d665a83..31924ff 100644
--- a/bindings/deno/.github/workflows/scorecard.yml
+++ b/bindings/deno/.github/workflows/scorecard.yml
@@ -20,5 +20,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/deno/.github/workflows/secret-scanner.yml b/bindings/deno/.github/workflows/secret-scanner.yml
index 82b3c70..682b409 100644
--- a/bindings/deno/.github/workflows/secret-scanner.yml
+++ b/bindings/deno/.github/workflows/secret-scanner.yml
@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: ../../../.github/workflows/secret-scanner-reusable.yml
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/haskell/.github/workflows/codeql.yml b/bindings/haskell/.github/workflows/codeql.yml
index de07c8f..e6bdb0e 100644
--- a/bindings/haskell/.github/workflows/codeql.yml
+++ b/bindings/haskell/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ permissions:
 
 jobs:
   analyze-js:
-    uses: ../../../.github/workflows/codeql-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     with:
       language: javascript-typescript
diff --git a/bindings/haskell/.github/workflows/governance.yml b/bindings/haskell/.github/workflows/governance.yml
index f5f282c..bd68b4c 100644
--- a/bindings/haskell/.github/workflows/governance.yml
+++ b/bindings/haskell/.github/workflows/governance.yml
@@ -24,4 +24,7 @@ permissions:
 
 jobs:
   governance:
-    uses: ../../../.github/workflows/governance-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/bindings/haskell/.github/workflows/hypatia-scan.yml b/bindings/haskell/.github/workflows/hypatia-scan.yml
index f120579..fbd8812 100644
--- a/bindings/haskell/.github/workflows/hypatia-scan.yml
+++ b/bindings/haskell/.github/workflows/hypatia-scan.yml
@@ -17,5 +17,9 @@ permissions:
 
 jobs:
   scan:
-    uses: ../../../.github/workflows/hypatia-scan-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/haskell/.github/workflows/mirror.yml b/bindings/haskell/.github/workflows/mirror.yml
index a20ae7d..639988a 100644
--- a/bindings/haskell/.github/workflows/mirror.yml
+++ b/bindings/haskell/.github/workflows/mirror.yml
@@ -11,5 +11,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: ../../../.github/workflows/mirror-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/haskell/.github/workflows/scorecard-enforcer.yml b/bindings/haskell/.github/workflows/scorecard-enforcer.yml
index bbba795..57bcadd 100644
--- a/bindings/haskell/.github/workflows/scorecard-enforcer.yml
+++ b/bindings/haskell/.github/workflows/scorecard-enforcer.yml
@@ -14,4 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/bindings/haskell/.github/workflows/scorecard.yml b/bindings/haskell/.github/workflows/scorecard.yml
index d665a83..31924ff 100644
--- a/bindings/haskell/.github/workflows/scorecard.yml
+++ b/bindings/haskell/.github/workflows/scorecard.yml
@@ -20,5 +20,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/haskell/.github/workflows/secret-scanner.yml b/bindings/haskell/.github/workflows/secret-scanner.yml
index 82b3c70..682b409 100644
--- a/bindings/haskell/.github/workflows/secret-scanner.yml
+++ b/bindings/haskell/.github/workflows/secret-scanner.yml
@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: ../../../.github/workflows/secret-scanner-reusable.yml
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/rust/.github/workflows/codeql.yml b/bindings/rust/.github/workflows/codeql.yml
index de07c8f..e6bdb0e 100644
--- a/bindings/rust/.github/workflows/codeql.yml
+++ b/bindings/rust/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ permissions:
 
 jobs:
   analyze-js:
-    uses: ../../../.github/workflows/codeql-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     with:
       language: javascript-typescript
diff --git a/bindings/rust/.github/workflows/governance.yml b/bindings/rust/.github/workflows/governance.yml
index f5f282c..bd68b4c 100644
--- a/bindings/rust/.github/workflows/governance.yml
+++ b/bindings/rust/.github/workflows/governance.yml
@@ -24,4 +24,7 @@ permissions:
 
 jobs:
   governance:
-    uses: ../../../.github/workflows/governance-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/bindings/rust/.github/workflows/hypatia-scan.yml b/bindings/rust/.github/workflows/hypatia-scan.yml
index f120579..fbd8812 100644
--- a/bindings/rust/.github/workflows/hypatia-scan.yml
+++ b/bindings/rust/.github/workflows/hypatia-scan.yml
@@ -17,5 +17,9 @@ permissions:
 
 jobs:
   scan:
-    uses: ../../../.github/workflows/hypatia-scan-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/rust/.github/workflows/mirror.yml b/bindings/rust/.github/workflows/mirror.yml
index a20ae7d..639988a 100644
--- a/bindings/rust/.github/workflows/mirror.yml
+++ b/bindings/rust/.github/workflows/mirror.yml
@@ -11,5 +11,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: ../../../.github/workflows/mirror-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/rust/.github/workflows/scorecard-enforcer.yml b/bindings/rust/.github/workflows/scorecard-enforcer.yml
index bbba795..57bcadd 100644
--- a/bindings/rust/.github/workflows/scorecard-enforcer.yml
+++ b/bindings/rust/.github/workflows/scorecard-enforcer.yml
@@ -14,4 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/bindings/rust/.github/workflows/scorecard.yml b/bindings/rust/.github/workflows/scorecard.yml
index d665a83..31924ff 100644
--- a/bindings/rust/.github/workflows/scorecard.yml
+++ b/bindings/rust/.github/workflows/scorecard.yml
@@ -20,5 +20,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/bindings/rust/.github/workflows/secret-scanner.yml b/bindings/rust/.github/workflows/secret-scanner.yml
index 82b3c70..682b409 100644
--- a/bindings/rust/.github/workflows/secret-scanner.yml
+++ b/bindings/rust/.github/workflows/secret-scanner.yml
@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: ../../../.github/workflows/secret-scanner-reusable.yml
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/editors/vscode/.github/workflows/codeql.yml b/editors/vscode/.github/workflows/codeql.yml
index de07c8f..e6bdb0e 100644
--- a/editors/vscode/.github/workflows/codeql.yml
+++ b/editors/vscode/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ permissions:
 
 jobs:
   analyze-js:
-    uses: ../../../.github/workflows/codeql-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     with:
       language: javascript-typescript
diff --git a/editors/vscode/.github/workflows/governance.yml b/editors/vscode/.github/workflows/governance.yml
index f5f282c..bd68b4c 100644
--- a/editors/vscode/.github/workflows/governance.yml
+++ b/editors/vscode/.github/workflows/governance.yml
@@ -24,4 +24,7 @@ permissions:
 
 jobs:
   governance:
-    uses: ../../../.github/workflows/governance-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/editors/vscode/.github/workflows/hypatia-scan.yml b/editors/vscode/.github/workflows/hypatia-scan.yml
index f120579..fbd8812 100644
--- a/editors/vscode/.github/workflows/hypatia-scan.yml
+++ b/editors/vscode/.github/workflows/hypatia-scan.yml
@@ -17,5 +17,9 @@ permissions:
 
 jobs:
   scan:
-    uses: ../../../.github/workflows/hypatia-scan-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/editors/vscode/.github/workflows/mirror.yml b/editors/vscode/.github/workflows/mirror.yml
index a20ae7d..639988a 100644
--- a/editors/vscode/.github/workflows/mirror.yml
+++ b/editors/vscode/.github/workflows/mirror.yml
@@ -11,5 +11,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: ../../../.github/workflows/mirror-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/editors/vscode/.github/workflows/scorecard-enforcer.yml b/editors/vscode/.github/workflows/scorecard-enforcer.yml
index bbba795..57bcadd 100644
--- a/editors/vscode/.github/workflows/scorecard-enforcer.yml
+++ b/editors/vscode/.github/workflows/scorecard-enforcer.yml
@@ -14,4 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/editors/vscode/.github/workflows/scorecard.yml b/editors/vscode/.github/workflows/scorecard.yml
index d665a83..31924ff 100644
--- a/editors/vscode/.github/workflows/scorecard.yml
+++ b/editors/vscode/.github/workflows/scorecard.yml
@@ -20,5 +20,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/editors/vscode/.github/workflows/secret-scanner.yml b/editors/vscode/.github/workflows/secret-scanner.yml
index 82b3c70..682b409 100644
--- a/editors/vscode/.github/workflows/secret-scanner.yml
+++ b/editors/vscode/.github/workflows/secret-scanner.yml
@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: ../../../.github/workflows/secret-scanner-reusable.yml
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/pandoc/.github/workflows/codeql.yml b/pandoc/.github/workflows/codeql.yml
index de07c8f..e6bdb0e 100644
--- a/pandoc/.github/workflows/codeql.yml
+++ b/pandoc/.github/workflows/codeql.yml
@@ -18,6 +18,10 @@ permissions:
 
 jobs:
   analyze-js:
-    uses: ../../../.github/workflows/codeql-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/codeql-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     with:
       language: javascript-typescript
diff --git a/pandoc/.github/workflows/governance.yml b/pandoc/.github/workflows/governance.yml
index f5f282c..bd68b4c 100644
--- a/pandoc/.github/workflows/governance.yml
+++ b/pandoc/.github/workflows/governance.yml
@@ -24,4 +24,7 @@ permissions:
 
 jobs:
   governance:
-    uses: ../../../.github/workflows/governance-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/governance-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/pandoc/.github/workflows/hypatia-scan.yml b/pandoc/.github/workflows/hypatia-scan.yml
index f120579..fbd8812 100644
--- a/pandoc/.github/workflows/hypatia-scan.yml
+++ b/pandoc/.github/workflows/hypatia-scan.yml
@@ -17,5 +17,9 @@ permissions:
 
 jobs:
   scan:
-    uses: ../../../.github/workflows/hypatia-scan-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/hypatia-scan-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/pandoc/.github/workflows/mirror.yml b/pandoc/.github/workflows/mirror.yml
index a20ae7d..639988a 100644
--- a/pandoc/.github/workflows/mirror.yml
+++ b/pandoc/.github/workflows/mirror.yml
@@ -11,5 +11,8 @@ permissions:
 
 jobs:
   mirror:
-    uses: ../../../.github/workflows/mirror-reusable.yml
+    permissions:
+      actions: read
+      contents: read
+    uses: hyperpolymath/standards/.github/workflows/mirror-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/pandoc/.github/workflows/scorecard-enforcer.yml b/pandoc/.github/workflows/scorecard-enforcer.yml
index bbba795..57bcadd 100644
--- a/pandoc/.github/workflows/scorecard-enforcer.yml
+++ b/pandoc/.github/workflows/scorecard-enforcer.yml
@@ -14,4 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
diff --git a/pandoc/.github/workflows/scorecard.yml b/pandoc/.github/workflows/scorecard.yml
index d665a83..31924ff 100644
--- a/pandoc/.github/workflows/scorecard.yml
+++ b/pandoc/.github/workflows/scorecard.yml
@@ -20,5 +20,8 @@ permissions:
 
 jobs:
   scorecard:
-    uses: ../../../.github/workflows/scorecard-reusable.yml
+    permissions:
+      contents: read
+      security-events: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit
diff --git a/pandoc/.github/workflows/secret-scanner.yml b/pandoc/.github/workflows/secret-scanner.yml
index 82b3c70..682b409 100644
--- a/pandoc/.github/workflows/secret-scanner.yml
+++ b/pandoc/.github/workflows/secret-scanner.yml
@@ -17,5 +17,5 @@ jobs:
   scan:
     permissions:
       contents: read
-    uses: ../../../.github/workflows/secret-scanner-reusable.yml
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@4e6ffe5568d7864f540d99c7d4ea9b9250ed30f2
     secrets: inherit