diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0fb54db..96bbd21 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -7,7 +7,7 @@ on:
   pull_request:
     branches: [main, master]
   schedule:
-    - cron: '0 6 * * 1'
+    - cron: '0 6 1 * *'   # monthly 1st 06:00 UTC
 
 # Estate guardrail: cancel superseded runs so re-pushes / rebased PR
 # updates do not pile up queued runs against the shared account-wide
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index f8f3fa4..4b4e754 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@0bbdab096651ee93f37ec02383e088183d41ff0b # pinned
+        uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/rust-ci.yml b/.github/workflows/rust-ci.yml
index b1b86c6..c60e60a 100644
--- a/.github/workflows/rust-ci.yml
+++ b/.github/workflows/rust-ci.yml
@@ -14,4 +14,4 @@ permissions:
 
 jobs:
   rust-ci:
-    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@8dc2bf039d1ff0372d650895c46bea7fbaec68ff
+    uses: hyperpolymath/standards/.github/workflows/rust-ci-reusable.yml@d135b05bfc647d0c0fbfedc7e80f37ea50f49236
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 11d9b2a..85b16ab 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -11,8 +11,4 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@81dbf2dd854b1444fd6236fa2352474383b2c2b9
-    permissions:
-      contents: read
-      security-events: write
-      id-token: write
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
\ No newline at end of file
diff --git a/.mise.toml b/.mise.toml
new file mode 100644
index 0000000..7c73b70
--- /dev/null
+++ b/.mise.toml
@@ -0,0 +1,10 @@
+[tools]
+# = "Uncomment and customize for your project"
+# = "rust nightly"
+# = "just 1.40.0"
+# = "nickel 1.10.0"
+# = "gleam 1.8.0"
+# = "elixir 1.18.0"
+# = "erlang 27.2"
+# = "zig 0.14.0"
+# = "idris2 0.7.0"
diff --git a/.tool-versions b/.tool-versions
deleted file mode 100644
index f8af37b..0000000
--- a/.tool-versions
+++ /dev/null
@@ -1,9 +0,0 @@
-# Uncomment and customize for your project
-# rust nightly
-# just 1.40.0
-# nickel 1.10.0
-# gleam 1.8.0
-# elixir 1.18.0
-# erlang 27.2
-# zig 0.14.0
-# idris2 0.7.0