diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2662630..53bde80 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,7 +94,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint Markdown
-        uses: melodic-software/ci-workflows/.github/actions/markdown@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/markdown@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           config: .markdownlint-cli2.jsonc
 
@@ -108,7 +108,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Spell-check
-        uses: melodic-software/ci-workflows/.github/actions/typos@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/typos@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           config: _typos.toml
 
@@ -122,7 +122,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check editorconfig conformance
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           config: .editorconfig-checker.json
 
@@ -136,7 +136,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Scan for secrets
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           config: .gitleaks.toml
 
@@ -150,7 +150,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check links and anchors (offline)
-        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           config: lychee.toml
           # The action's default `**/*.md` skips hidden directories, so Markdown
@@ -174,7 +174,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint workflows
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
 
   jsonschema:
     if: ${{ !(github.event.pull_request.head.repo.full_name == github.repository && (contains(fromJSON('["labeled","unlabeled"]'), github.event.action) || (github.event.action == 'edited' && !github.event.changes.base))) }}
@@ -186,12 +186,12 @@ jobs:
         with:
           persist-credentials: false
       - name: Validate dependabot.yml
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           builtin-schema: vendor.dependabot
           files: .github/dependabot.yml
       - name: Validate workflows
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           builtin-schema: vendor.github-workflows
           files: .github/workflows/*.yml
@@ -231,12 +231,12 @@ jobs:
           fi
           echo "files=${forms[*]}" >> "$GITHUB_OUTPUT"
       - name: Validate issue forms
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           builtin-schema: vendor.github-issue-forms
           files: ${{ steps.issue-forms.outputs.files }}
       - name: Validate issue-template chooser config
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           builtin-schema: vendor.github-issue-config
           files: .github/ISSUE_TEMPLATE/config.yml
@@ -246,7 +246,7 @@ jobs:
       # breaking schemastore change reddens the lane without this repo changing
       # — swap to a builtin if one ever ships.
       - name: Validate Claude Code settings
-        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/check-jsonschema@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           schemafile: https://json.schemastore.org/claude-code-settings.json
           files: .claude/settings.json
@@ -268,7 +268,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Lint shell scripts
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           rcfile: .shellcheckrc
 
@@ -282,7 +282,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check index-level EOL drift
-        uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/eol-renormalize@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
 
   # Compares `.github/PULL_REQUEST_TEMPLATE.md` headings and
   # `.claude/source-control.md`'s `pr_body_required_sections` to the
@@ -326,7 +326,7 @@ jobs:
       statuses: write
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-contract@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/pr-contract@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           token: ${{ github.token }}
       - name: Aggregate lane results
@@ -334,7 +334,7 @@ jobs:
         # aggregation: the job still fails on the contract step's exit code, and
         # the `ci-lanes` status is on the SHA for the next contract-only run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/ci-status@5776760254f8b63cba44e896f51604cb755350d9 # v0.22.2
+        uses: melodic-software/ci-workflows/.github/actions/ci-status@2c1de45aa0e1b1489afb8edfebc12cb3a4fa6ac3 # v0.24.0
         with:
           # Derived from `needs:` rather than restating it. Hand-listing the
           # results let a lane be dropped from this input alone — still gated via