diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md
index 34878c9..1973db6 100644
--- a/DEFENSE_IN_DEPTH.md
+++ b/DEFENSE_IN_DEPTH.md
@@ -50,4 +50,4 @@ Profile: npm library · public
 ## 7. Repository lockdown
 - [ ] Phishing-resistant 2FA (passkeys / hardware keys) on the GitHub and npm accounts (manual)
 - [ ] Recovery codes stored offline in a password manager (manual)
-- [ ] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos))
+- [x] `lockdown-repo.sh` applied by a repo admin (never committed to this repo); `--check` with `--required-checks` and `--allowed-actions` passes (PRs required on the default branch, merges blocked unless required status checks pass, tag ruleset, immutable releases, fork-PR approval (public repos), read-only workflow tokens, Actions allowlist, secret scanning, Dependabot disabled, private vulnerability reporting (public repos)) — PR #77 (admin apply 2026-09-10, all 9 settings ✓; this token’s `--check` 403s Actions permission APIs; rulesets `Pull requests required` and `Tags only by admins` confirmed via API)
diff --git a/SECURITY.md b/SECURITY.md
index 1d4d1b8..a0aa683 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -23,9 +23,12 @@ We will acknowledge receipt, work with you on a coordinated disclosure timeline,
 This repository follows the [defense-in-depth](https://github.com/jaredwray/agentic/blob/main/skills/security/defense-in-depth-nodejs/SKILL.md)
 hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_DEPTH.md). Measures currently in place:
 
+- All changes land through pull requests — direct pushes to `main` are blocked, and merging requires the `zizmor` and `build` status checks. Tags can only be created by repository admins; published GitHub Releases are immutable.
+- Workflow runs from outside collaborators require maintainer approval. Default workflow tokens are read-only, and only allowlisted GitHub Actions can run (`zizmorcore/*`, `SocketDev/*`, `pnpm/*`, `codecov/*`, plus GitHub-owned and verified creators).
+- Secret scanning and push protection are enabled. Dependabot alerts and security-update PRs are off; there is no Dependabot config.
 - pnpm is pinned via `packageManager` (`pnpm@12.3.0`).
 - Dependencies install through pnpm with a 7-day cooldown on new versions, lifecycle scripts blocked by default, `trustPolicy: no-downgrade`, and exotic subdependencies blocked.
-- The lockfile is committed and CI installs with `--frozen-lockfile`. There is no Dependabot config; dependency updates go through reviewed PRs.
+- The lockfile is committed and CI installs with `--frozen-lockfile`.
 - CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; zizmor lints workflows on every PR; checkouts that do not push set `persist-credentials: false`.
 - The release workflow disables `setup-node` package-manager caching and stages packed tarballs with `pnpm stage publish` instead of publishing live.
 - Workflows do not use `pull_request_target`.