diff --git a/.github/workflows/auto-merge-deps.yml b/.github/workflows/auto-merge-deps.yml
index 6b6c8ad..bba2083 100644
--- a/.github/workflows/auto-merge-deps.yml
+++ b/.github/workflows/auto-merge-deps.yml
@@ -14,3 +14,8 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
+    # Merge with the org App so the merge commit gets a CI run (#450).
+    # Only these two secrets are passed, not `secrets: inherit`.
+    secrets:
+      merge-app-id: ${{ secrets.PROJECT_APP_ID }}
+      merge-app-private-key: ${{ secrets.PROJECT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index c3e0b7e..3e51b2b 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -1,9 +1,7 @@
 name: Security
 
 # Aggregated security scans for skill repos:
-#   gitleaks         — secret scanning. The job and the reusable keep the
-#                      historical `gitleaks` name; the scan itself runs
-#                      betterleaks, which is OSS and needs no license.
+#   betterleaks      — secret scanning (OSS, needs no license).
 #   zizmor           — static analysis of this repo's own workflows.
 #   dependency-review — on pull requests only.
 #   composer-audit   — `composer audit` AND an Opengrep SAST scan; the called
@@ -26,8 +24,8 @@ on:
 permissions: {}
 
 jobs:
-  gitleaks:
-    uses: netresearch/.github/.github/workflows/gitleaks.yml@main
+  betterleaks:
+    uses: netresearch/.github/.github/workflows/betterleaks.yml@main
     permissions:
       contents: read
       security-events: write