diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a375e8a..fcb8759 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -28,14 +28,14 @@ jobs:
 
   rpmbuild:
     needs: [config]
-    uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.9
+    uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
     secrets: inherit
     with:
       artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }}
 
   rpmsign:
     needs: [config, rpmbuild]
-    uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.9
+    uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
     secrets: inherit
     with:
       artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }}
@@ -44,7 +44,7 @@ jobs:
 
   rpmvalidate:
     needs: [config, rpmsign]
-    uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@v3.9
+    uses: OpenCHAMI/github-actions/.github/workflows/validate-rpm-quadlet.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
     secrets: inherit
     with:
       artifact-name-signed-rpms:   ${{ needs.config.outputs.rpm-signed }}
diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
index 34188ef..ac5e75e 100644
--- a/.github/workflows/cleanup.yml
+++ b/.github/workflows/cleanup.yml
@@ -7,8 +7,9 @@ on:
   pull_request:
     types: [closed]
 
+permissions:
+  packages: write
+
 jobs:
   cleanup:
-    uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@v3.9
-    permissions:
-      packages: write
+    uses: OpenCHAMI/github-actions/.github/workflows/pr-registry-cleanup.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4465799..b73fc4f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,14 +32,14 @@ jobs:
 
   rpmbuild:
     needs: [config]
-    uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@v3.9
+    uses: OpenCHAMI/github-actions/.github/workflows/build-rpm-quadlet.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
     secrets: inherit
     with:
       artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }}
 
   rpmsign:
     needs: [config, rpmbuild]
-    uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@v3.9
+    uses: OpenCHAMI/github-actions/.github/workflows/gpg-sign-artifacts.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
     secrets: inherit
     with:
       artifact-name-unsigned-rpms: ${{ needs.config.outputs.rpm-unsigned }}
@@ -48,7 +48,7 @@ jobs:
 
   release:
     needs: [config, rpmsign]
-    uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@v3.9
+    uses: OpenCHAMI/github-actions/.github/workflows/release-signed-artifacts.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
     secrets: inherit
     with:
       artifact-name-signed-rpms: ${{ needs.config.outputs.rpm-signed }}
@@ -57,5 +57,5 @@ jobs:
 
   publish:
     needs: release
-    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@v3.9
+    uses: OpenCHAMI/github-actions/.github/workflows/publish-release.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
     secrets: inherit
diff --git a/.github/workflows/reuse.yml b/.github/workflows/reuse.yml
new file mode 100644
index 0000000..2846a63
--- /dev/null
+++ b/.github/workflows/reuse.yml
@@ -0,0 +1,13 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
+name: REUSE
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  reuse:
+    uses: OpenCHAMI/github-actions/.github/workflows/reuse.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
new file mode 100644
index 0000000..084cd04
--- /dev/null
+++ b/.github/workflows/scorecard.yml
@@ -0,0 +1,21 @@
+# SPDX-FileCopyrightText: © 2026 OpenCHAMI a Series of LF Projects, LLC
+#
+# SPDX-License-Identifier: MIT
+
+name: Scorecard
+on:
+  branch_protection_rule:
+  pull_request:
+  push:
+    branches: [main]
+  schedule:
+    - cron: '39 5 * * 1'
+
+permissions:
+  contents: read
+  security-events: write
+  id-token: write
+
+jobs:
+  scorecard:
+    uses: OpenCHAMI/github-actions/.github/workflows/scorecard.yml@8143942058adef1ce81a96a11ae9074358df4fbd # v3.11
diff --git a/README.md b/README.md
index f13a30a..ccbba78 100644
--- a/README.md
+++ b/README.md
@@ -19,4 +19,4 @@ sudo systemctl start haproxy.service
 
 Edit `/etc/openchami/configs/haproxy.cfg` to change routing. For Podman or systemd changes, add a drop-in under `/etc/containers/systemd/haproxy.container.d/` rather than editing the packaged one, then run `systemctl daemon-reload`.
 
-TLS certificates are read from the `haproxy-certs` volume, which `openchami-acme-quadlets` populates; supply your own there if you are not using ACME.
+TLS certificates are read from the `haproxy-certs` volume, which `openchami-acme-quadlet` populates; supply your own there if you are not using ACME.
diff --git a/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec b/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec
index 30af8fc..13257bd 100644
--- a/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec
+++ b/packaging/rpm-quadlet/openchami-haproxy-quadlet.spec
@@ -22,9 +22,9 @@ Requires(post,preun,postun):  systemd
 # systemd-style *.container.d drop-in directories
 Requires:                     podman >= 5.0.0
 
-# NOTE: openchami-acme-quadlets populates the haproxy-certs volume that
+# NOTE: openchami-acme-quadlet populates the haproxy-certs volume that
 # terminates TLS, but a site may install its own certificates there instead.
-Suggests:                     openchami-acme-quadlets >= 0.0.1
+Suggests:                     openchami-acme-quadlet >= 0.0.1
 Suggests:                     boot-service-quadlet >= 0.3.2
 Suggests:                     metadata-service-quadlet >= 0.2.2
 Suggests:                     smd-quadlet >= 2.20.5