diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index dec68e8..47ccc7f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -14,10 +14,7 @@ permissions:
 
 jobs:
   scorecard:
-    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@571cc734cd69fb846032ec77a662aa8ee4fc32cd
-    # Reusable called-workflow permissions are CAPPED by the caller's grants;
-    # without security-events: write here the scorecard SARIF upload fails with
-    # startup_failure (hypatia WF018). id-token: write enables OIDC publish.
+    uses: hyperpolymath/standards/.github/workflows/scorecard-reusable.yml@d7c22711e830e1f383846472f6e9b99debdb201e
     permissions:
       contents: read
       security-events: write