diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 5e5be7f..fa6eb1f 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -1,4 +1,13 @@
 # SPDX-License-Identifier: MPL-2.0
+# Prevention workflow - scans for hardcoded secrets before they reach main.
+#
+# Calls the estate's shared secret scanner (gitleaks + rust-secrets +
+# shell-secrets). The job key MUST stay `scan`: the estate-wide
+# Secret-Scan-Floor ruleset requires the check context `scan / gitleaks`.
+#
+# No `secrets:` line, deliberately: the reusable references no secrets
+# (gitleaks runs as a checksum-verified binary, not gitleaks-action), so
+# `secrets: inherit` would only hand it every repo and org secret (CWE-250).
 name: Secret Scanner
 
 on:
@@ -15,16 +24,4 @@ permissions:
 
 jobs:
   scan:
-  permissions:
-    actions: read
-    contents: read
-    security-events: write
-# The reusable's gitleaks job requests pull-requests: write (PR summary
-    # comment) and actions: read (workflow-run metadata) at job level; the
-    # caller must grant at least that or the run startup-fails.
-    permissions:
-      contents: read
-      pull-requests: write
-      actions: read
-    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@c65436ee3351cd6b0fa14b142938b195efc77586
-    secrets: inherit
+    uses: hyperpolymath/standards/.github/workflows/secret-scanner-reusable.yml@74d2f66f575246cf6e313ae7775f44df6e097ff2