diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66902d6..e286b52 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,142 +6,27 @@ on:
   pull_request:
     branches: [main]
 
-env:
-  CARGO_TERM_COLOR: always
-  RUSTFLAGS: -D warnings
+permissions:
+  contents: read
 
 jobs:
-  fmt:
-    name: Format
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: rustfmt
-      - run: cargo fmt --check
-
-  clippy:
-    name: Clippy
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: clippy
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo clippy --workspace --all-targets -- -D warnings
-
-  test:
-    name: Test (${{ matrix.os }})
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo test --workspace --all-features
-
-  msrv:
-    name: MSRV (1.81)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@1.81
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - run: cargo build --workspace
-
-  coverage:
-    name: Coverage (100% lines)
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-        with:
-          components: llvm-tools-preview
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
-      - uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
-        with:
-          tool: cargo-llvm-cov
-      # Each executable source line must be hit at least once.
-      #
-      # Exception — panic-free defence in depth: a line carrying a
-      # `// cov:unreachable` marker is unreachable under a dominating invariant,
-      # kept deliberately to stay panic-free if that invariant is ever broken by
-      # a future change. Such lines cannot be exercised by any test and are
-      # exempt. The gate fails on any OTHER zero-hit line.
-      - name: Generate lcov
-        run: cargo llvm-cov --workspace --all-features --lcov --output-path lcov.info
-      - name: Enforce line coverage (unreachable defensive arms must carry // cov:unreachable)
-        shell: bash
-        run: |
-          fail=0
-          while IFS= read -r line; do
-            if [[ "$line" == SF:* ]]; then
-              f="${line#SF:}"
-            elif [[ "$line" =~ ^DA:([0-9]+),0$ ]]; then
-              n="${BASH_REMATCH[1]}"
-              src="$(sed -n "${n}p" "$f")"
-              if [[ "$src" == *cov:unreachable* ]]; then
-                echo "exempt (// cov:unreachable): $f:$n"
-              else
-                echo "::error::Uncovered line $f:$n:$src"
-                fail=1
-              fi
-            fi
-          done < lcov.info
-          if [[ "$fail" -ne 0 ]]; then exit 1; fi
-          echo "All executable lines covered, or annotated // cov:unreachable."
-
-  deny:
-    name: cargo-deny
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
-        with:
-          command: check
-
-  vet:
-    name: Cargo Vet (supply-chain)
-    runs-on: ubuntu-latest
-    # Complements `deny` (known-bad advisories/licenses) with the supply-chain-
-    # injection layer: every dependency version must be human-source-reviewed or
-    # covered by an imported aggregate audit set (Google/Mozilla/Bytecode-Alliance/
-    # Embark). Config in supply-chain/{config,audits,imports}.toml.
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-      - name: Install cargo-vet
-        uses: taiki-e/install-action@59012be0884e296ca2da49b530610e72c49039ad # v2.81.6
-        with:
-          tool: cargo-vet
-      - name: Fetch dependencies
-        run: cargo fetch
-      - name: Check supply chain
-        run: cargo vet --locked
-
-  gitleaks:
-    name: gitleaks
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-        with:
-          fetch-depth: 0
-      - name: gitleaks (license-free binary)
-        run: |
-          VER=8.21.2
-          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${VER}/gitleaks_${VER}_linux_x64.tar.gz" | tar -xz gitleaks
-          CFG=""; [ -f .gitleaks.toml ] && CFG="--config .gitleaks.toml"
-          ./gitleaks detect --source . --redact --no-banner $CFG
-
+  # fmt · clippy · test (3 OS) · MSRV · cargo-deny · cargo-vet · secret scan ·
+  # fuzz build-check · per-line coverage gate.
+  #
+  # Every default fits this repo, so there is nothing to override: MSRV is
+  # derived from rust-version (1.81), coverage is already the per-line gate at
+  # --workspace --all-features, and core/fuzz is discovered automatically.
+  ci:
+    uses: SecurityRonin/fleet-ci/.github/workflows/rust-ci.yml@6b5502293ffb656c7ded8998c5acc704b5cee431
+
+  # Repo-specific, so it stays here rather than moving into the shared workflow.
   docs:
     name: Docs
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@9bdad043e88c75890e36ad3bbc8d27f0090dd609 # v2.7.8
+      - uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@9d47c6ad4b02e050fd481d890b2ea34778fd09d6 # v2.7.8
       - run: RUSTDOCFLAGS="-D warnings" cargo doc --no-deps --workspace