diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index cd5ab00..8646438 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,16 +1,7 @@
 # Synced from cplieger/ci/.github/workflow-templates/ci.yml — DO NOT EDIT.
-# Single CI template for all releaseable repos. The central ci.yaml reusable
-# workflow auto-detects repo surfaces (go.mod / jsr.json / Dockerfile / nested
-# web frontend) and dispatches to the appropriate reusable workflow. Hybrid
-# repos (Go + TS web frontend) run multiple jobs in parallel automatically —
-# no per-repo configuration needed.
-#
-# No paths-ignore: the required status check (ci / validate) can never be
-# satisfied if the workflow is skipped by a path filter — GitHub leaves the
-# check pending forever, permanently blocking docs-only PRs. The workflow
-# therefore always runs; the central ci.yaml gates the heavy language jobs on a
-# real code change (so docs-only pushes run only detect + markdown + validate)
-# and always runs the markdown lint.
+# No paths-ignore: a workflow skipped by a path filter leaves the required
+# ci / validate pending forever, so the meta ci.yaml gates its heavy jobs on a
+# real code change instead.
 name: CI
 
 # Both branches stay listed: a repo that has not adopted a dev branch keeps
@@ -35,4 +26,8 @@ concurrency:
 
 jobs:
   ci:
-    uses: cplieger/ci/.github/workflows/ci.yaml@c618b7c797a916cac79b209d004ac38111ef83c3 # v3
+    # The dead-code check uploads its findings to code scanning.
+    permissions:
+      contents: read
+      security-events: write
+    uses: cplieger/ci/.github/workflows/ci.yaml@c5c2a1ca2199a2eb407227df3b56a837b99cc736 # v3
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b4a1f0f..bb94860 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,4 +25,4 @@ jobs:
       security-events: write
       contents: read
       actions: read
-    uses: cplieger/ci/.github/workflows/codeql.yaml@c618b7c797a916cac79b209d004ac38111ef83c3 # v3
+    uses: cplieger/ci/.github/workflows/codeql.yaml@c5c2a1ca2199a2eb407227df3b56a837b99cc736 # v3
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 7b5691a..d29e120 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -52,7 +52,7 @@ jobs:
       id-token: write
       attestations: write
       security-events: write
-    uses: cplieger/ci/.github/workflows/release.yaml@c618b7c797a916cac79b209d004ac38111ef83c3 # v3
+    uses: cplieger/ci/.github/workflows/release.yaml@c5c2a1ca2199a2eb407227df3b56a837b99cc736 # v3
     # Forward only the two Docker Hub publish credentials the reusable pipeline
     # actually declares and consumes, rather than `secrets: inherit` (which
     # exposes every repo secret to the reusable-workflow trust boundary). Both
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index dd7a4f6..d36a9c5 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -28,4 +28,4 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: cplieger/ci/.github/workflows/security-scan.yaml@c618b7c797a916cac79b209d004ac38111ef83c3 # v3
+    uses: cplieger/ci/.github/workflows/security-scan.yaml@c5c2a1ca2199a2eb407227df3b56a837b99cc736 # v3
diff --git a/.golangci.yaml b/.golangci.yaml
index 7b8d56b..2218a98 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -8,9 +8,9 @@ run:
 
 linters:
   default: standard
-  # unused, ineffassign and wastedassign are off: go-ci's deadset step reports
-  # the same findings (DS1002, DS1003, DS1807) and gates on them in every Go
-  # module.
+  # unused, ineffassign and wastedassign are off: the deadset check
+  # (deadset-ci.yaml) reports the same findings (DS1002, DS1003, DS1807) and
+  # gates on them in every Go module.
   disable:
     - unused
     - ineffassign