diff --git a/.githooks/validate-actions-lock.sh b/.githooks/validate-actions-lock.sh
index d66997261..4566a7168 100755
--- a/.githooks/validate-actions-lock.sh
+++ b/.githooks/validate-actions-lock.sh
@@ -68,9 +68,6 @@ EXPECTED_ABSENT=(
   # governance-reusable.yml. The cure is to remove the consumer -- port the
   # governance scripts to bun -- not to satisfy it.
   "denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed"
-  # A2ML is dead. security-gate-pr-target.yml still calls its
-  # secrets-check-action; locking it in would connect new machinery to it.
-  "hyperpolymath/a2ml-ecosystem@f7a40a4d5cc82b2e73f861119baa6818d77a448d"
 )
 
 if [ ! -f "$LOCKFILE" ]; then
diff --git a/.github/workflows/security-gate-pr-target.yml b/.github/workflows/security-gate-pr-target.yml
index 784f9963b..1f123595c 100644
--- a/.github/workflows/security-gate-pr-target.yml
+++ b/.github/workflows/security-gate-pr-target.yml
@@ -86,15 +86,6 @@ jobs:
 
           echo "pr_checked_out=true" >> "$GITHUB_OUTPUT"
 
-      - name: Security Scan - Secrets Detection
-        if: steps.fork-check.outputs.is_fork == 'true' && steps.pr-checkout.outputs.pr_checked_out == 'true'
-        id: secrets-scan
-        uses: hyperpolymath/a2ml-ecosystem/secrets-check-action@f7a40a4d5cc82b2e73f861119baa6818d77a448d # frozen: A2ML retired (see EXPECTED_ABSENT in .githooks/validate-actions-lock.sh)
-        with:
-          path: '.'
-          strict: 'true'
-        continue-on-error: false
-
       - name: Security Scan - Malicious Content Detection
         if: steps.fork-check.outputs.is_fork == 'true' && steps.pr-checkout.outputs.pr_checked_out == 'true'
         id: malicious-scan