diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index bf57f5f..09ff85a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,11 +29,11 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           languages: javascript-typescript
           build-mode: none
           queries: security-extended
 
       - name: Analyze
-        uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e120c1a..0a7b1d5 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -41,6 +41,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif
diff --git a/profile/README.md b/profile/README.md
index 50486a2..7e6e7c0 100644
--- a/profile/README.md
+++ b/profile/README.md
@@ -8,10 +8,10 @@ Use Xquik for X data, monitoring, exports, webhooks, and approved account action
 
 | Surface | Contract |
 | --- | --- |
-| REST API | 127 OpenAPI-backed operations |
+| REST API | 128 OpenAPI-backed operations |
 | OpenAPI | 3.1.0 schema at [xquik.com/openapi.json](https://xquik.com/openapi.json) |
-| MCP | 119 catalog routes through 2 tools |
-| MCP responses | 118 JSON or text operations are supported. Binary support downloads use REST |
+| MCP | 120 catalog routes through 2 tools |
+| MCP responses | 119 JSON or text operations are supported. Binary support downloads use REST |
 | Authentication | API keys or OAuth 2.1, depending on the client |
 | Webhooks | HMAC-SHA256 signed deliveries |
 
diff --git a/scripts/check-public-contract.mjs b/scripts/check-public-contract.mjs
index b54d061..3d2506b 100644
--- a/scripts/check-public-contract.mjs
+++ b/scripts/check-public-contract.mjs
@@ -114,7 +114,7 @@ const STALE_PUBLIC_COPY = [
   /\b47\+ (?:agents|integrations|tools)/iu,
   /\b126 (?:API |OpenAPI |REST )?operations/iu,
   /\b127 endpoints/iu,
-  /\b120 (?:catalog )?routes/iu,
+  /\b119 catalog routes/iu,
   /\b118 (?:catalog )?routes/iu,
   /\b118 operations through 2 tools/iu,
   /\b2\.5\.4\b/u,
@@ -231,6 +231,7 @@ function contentUrl(repo, path) {
 }
 
 async function loadRepoFile(repo, path) {
+  if (repo.name === ".github") return readFile(path, "utf8");
   return fetchText(contentUrl(repo, path), "application/vnd.github.raw+json");
 }