diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 56a22cf..f698695 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -20,16 +20,14 @@ permissions:
 jobs:
   dotnet:
     name: .NET Build & Test
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-dotnet.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@main
     with:
       working-directory: api
       solution: ProposalSystem.sln
 
   web:
     name: Web Frontend Check
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-typescript-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
       working-directory: web
       cache-dependency-path: web/package-lock.json
@@ -56,8 +54,7 @@ jobs:
 
   python:
     name: Python Lint
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-python-sam.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@main
     with:
       source-dirs: "lambdas/"
       run-sam-validate: false
@@ -85,8 +82,7 @@ jobs:
 
   mobile:
     name: Mobile Typecheck
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-typescript-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
@@ -96,8 +92,7 @@ jobs:
 
   infra:
     name: CDK Synth
-    # Fix: INF-M8 — pin to SHA for supply chain security (ci-typescript-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
     with:
       working-directory: infra
       cache-dependency-path: infra/package-lock.json
diff --git a/.github/workflows/deploy-mobile.yaml b/.github/workflows/deploy-mobile.yaml
index b3a5434..f8d73e6 100644
--- a/.github/workflows/deploy-mobile.yaml
+++ b/.github/workflows/deploy-mobile.yaml
@@ -15,8 +15,7 @@ permissions:
 jobs:
   deploy-ios:
     name: Build & Upload to TestFlight
-    # Fix: INF-M8 — pin to SHA for supply chain security (cd-mobile-ios.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@main
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index a0a785c..50c170e 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -15,8 +15,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy to AWS
-    # Fix: INF-M8 — pin to SHA for supply chain security (cd-cdk.yaml@main)
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@c040bfaa223ac9a671cca9047cffdac45b00f3dc
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
     with:
       cdk-dir: infra
       dotnet-version: "8.0.x"