diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..6c3d63c
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,29 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/code-hygiene-self-test.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'hyperpolymath/deed-ecosystem@main'
+        - 'hyperpolymath/k9-ecosystem@main'
+    '.github/workflows/main-estate-audit.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'hyperpolymath/deed-ecosystem@main'
+        - 'hyperpolymath/k9-ecosystem@main'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'hyperpolymath/deed-ecosystem@main':
+        ref: 'main'
+        commit: 'sha1-f7a40a4d5cc82b2e73f861119baa6818d77a448d'
+        owner_id: 6759885
+        repo_id: 1275649586
+    'hyperpolymath/k9-ecosystem@main':
+        ref: 'main'
+        commit: 'sha1-2155aa26a21758f2ba119f61bc7e0e1981c106fb'
+        owner_id: 6759885
+        repo_id: 1275650185
diff --git a/.github/workflows/code-hygiene-self-test.yml b/.github/workflows/code-hygiene-self-test.yml
index a90ea23..a076667 100644
--- a/.github/workflows/code-hygiene-self-test.yml
+++ b/.github/workflows/code-hygiene-self-test.yml
@@ -1,3 +1,6 @@
+# This workflow is managed by gh actions-lock.
+
+# SPDX-License-Identifier: MPL-2.0
 name: Code Hygiene Self-Test
 
 on:
@@ -32,8 +35,9 @@ jobs:
   test:
     name: Gate controls
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - run: bash actions/code-hygiene-check/test.sh
@@ -55,19 +59,19 @@ jobs:
           printf '%s\n' 'K9!' '# SPDX-License-Identifier: MPL-2.0' 'invalid manifest' > "$root/bad-k9/control.k9.ncl"
           echo "root=$root" >> "$GITHUB_OUTPUT"
       - name: Valid manifests must pass
-        uses: ./actions/manifest-check
+        uses: $/actions/manifest-check
         with:
           path: ${{ steps.fixtures.outputs.root }}/valid
       - name: Invalid A2ML must fail
         id: bad-a2ml
         continue-on-error: true
-        uses: ./actions/manifest-check
+        uses: $/actions/manifest-check
         with:
           path: ${{ steps.fixtures.outputs.root }}/bad-a2ml
       - name: Invalid K9 Nickel manifest must fail
         id: bad-k9
         continue-on-error: true
-        uses: ./actions/manifest-check
+        uses: $/actions/manifest-check
         with:
           path: ${{ steps.fixtures.outputs.root }}/bad-k9
       - name: Verify both negative controls failed
diff --git a/.github/workflows/label-triage.yml b/.github/workflows/label-triage.yml
index 9886e92..814a192 100644
--- a/.github/workflows/label-triage.yml
+++ b/.github/workflows/label-triage.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Label Triage
 
diff --git a/.github/workflows/labels.yml b/.github/workflows/labels.yml
index c80b676..83ab941 100644
--- a/.github/workflows/labels.yml
+++ b/.github/workflows/labels.yml
@@ -1,3 +1,4 @@
+# This workflow is managed by gh actions-lock.
 # SPDX-License-Identifier: MPL-2.0
 name: Labels
 
diff --git a/.github/workflows/main-estate-audit.yml b/.github/workflows/main-estate-audit.yml
index b6d474c..edee14f 100755
--- a/.github/workflows/main-estate-audit.yml
+++ b/.github/workflows/main-estate-audit.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: Central Estate CI/CD Audit
 
 on:
@@ -12,84 +14,84 @@ jobs:
     steps:
       # Test the actions from this revision, not the older implementations on
       # main. The pinned checkout is the only remote action this job needs.
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       
       - name: Required Files Gate
-        uses: ./actions/required-files-check
+        uses: $/actions/required-files-check
         
       - name: Code Hygiene Gate
-        uses: ./actions/code-hygiene-check
+        uses: $/actions/code-hygiene-check
         
       - name: Manifest Validation Gate
-        uses: ./actions/manifest-check
+        uses: $/actions/manifest-check
         
       - name: Idris2 ABI Purity Gate
-        uses: ./actions/idris2-abi-check
+        uses: $/actions/idris2-abi-check
         
       - name: Zig Hexadeca API Gate
-        uses: ./actions/zig-hexadeca-check
+        uses: $/actions/zig-hexadeca-check
         
       - name: Contractile Validation Gate
-        uses: ./actions/contractile-validation-check
+        uses: $/actions/contractile-validation-check
         
       - name: Recipes Set Validation Gate
-        uses: ./actions/recipes-set-check
+        uses: $/actions/recipes-set-check
         
       - name: Affirmation Document Gate
-        uses: ./actions/affirmation-check
+        uses: $/actions/affirmation-check
         
       - name: Academic Referencing Gate
-        uses: ./actions/referencing-check
+        uses: $/actions/referencing-check
         
       - name: Semantic Audit Gate
-        uses: ./actions/semantic-audit-check
+        uses: $/actions/semantic-audit-check
         
       - name: SPDX License Gate
-        uses: ./actions/spdx-license-check
+        uses: $/actions/spdx-license-check
         
       - name: Proof Runner Gate
-        uses: ./actions/proof-runner-check
+        uses: $/actions/proof-runner-check
         
       - name: PRAT Testing Gate
-        uses: ./actions/prat-check
+        uses: $/actions/prat-check
         
       - name: Panic Attack & Pons Gate
-        uses: ./actions/custom-tools-check
+        uses: $/actions/custom-tools-check
         
       - name: WWW & Well-Known Compliance Gate
-        uses: ./actions/www-compliance-check
+        uses: $/actions/www-compliance-check
         
       - name: BoJ Cartridge Validation Gate
-        uses: ./actions/boj-cartridge-check
+        uses: $/actions/boj-cartridge-check
         
       - name: Formatting Validation Gate
-        uses: ./actions/formatting-check
+        uses: $/actions/formatting-check
         
       - name: Accreditations & Badges Gate
-        uses: ./actions/badges-check
+        uses: $/actions/badges-check
         
       - name: Metrics Extraction Gate
-        uses: ./actions/metrics-check
+        uses: $/actions/metrics-check
         
       - name: Linguist & Banned Languages Gate
-        uses: ./actions/linguist-check
+        uses: $/actions/linguist-check
         
       - name: Test & Benchmarks Dashboard Gate
-        uses: ./actions/tests-benches-check
+        uses: $/actions/tests-benches-check
         
       - name: Hosting & Site Status Gate
-        uses: ./actions/hosting-check
+        uses: $/actions/hosting-check
         
       - name: Git-Sea Analytics Gate
-        uses: ./actions/gitsea-check
+        uses: $/actions/gitsea-check
         
       - name: Trust & Humans Validation Gate
-        uses: ./actions/trust-humans-check
+        uses: $/actions/trust-humans-check
         
       - name: Are We UnAPI Gate (Secret Scanning)
-        uses: ./actions/secrets-check
+        uses: $/actions/secrets-check
         
       - name: Reasonably Good Token Validation Gate
-        uses: ./actions/vaulted-tokens-check
+        uses: $/actions/vaulted-tokens-check
diff --git a/actions/manifest-check/action.yml b/actions/manifest-check/action.yml
index 75c14be..8d74f33 100755
--- a/actions/manifest-check/action.yml
+++ b/actions/manifest-check/action.yml
@@ -14,12 +14,12 @@ runs:
   using: 'composite'
   steps:
     - name: Validate A2ML and DEED manifests
-      uses: hyperpolymath/deed-ecosystem/validate-action@f7a40a4d5cc82b2e73f861119baa6818d77a448d
+      uses: hyperpolymath/deed-ecosystem/validate-action@main
       with:
         path: ${{ inputs.path }}
         strict: ${{ inputs.strict }}
     - name: Validate K9 manifests
-      uses: hyperpolymath/k9-ecosystem/validate-action@2ee51eed590b4722efcdca2fe4685ef24600bced
+      uses: hyperpolymath/k9-ecosystem/validate-action@main
       with:
         path: ${{ inputs.path }}
         strict: ${{ inputs.strict }}