diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index a5fab80..f4e1d39 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -8,7 +8,7 @@
 #   permissions: { contents: read, pull-requests: write, issues: write }
 #   jobs:
 #     label:
-#       uses: QAtlasHub/.github/.github/workflows/labeler.yml@v1
+#       uses: QAtlasHub/.github/.github/workflows/labeler.yml@main
 #       with: { runner: '["self-hosted","rosina"]' }
 #
 # THE LABELS ARE SET THROUGH THE API, NEVER THROUGH `gh pr edit`. That command reads the
diff --git a/.github/workflows/tagbot.yml b/.github/workflows/tagbot.yml
index 154cf76..cd4f2c5 100644
--- a/.github/workflows/tagbot.yml
+++ b/.github/workflows/tagbot.yml
@@ -5,11 +5,19 @@
 #     schedule: [{ cron: "17 4 * * *" }]    # daily self-backfill — no JuliaTagBot app needed
 #     issue_comment: { types: [created] }    # JuliaTagBot app trigger, if ever installed
 #     workflow_dispatch:                      # manual catch-up
-#   jobs: { tagbot: { uses: QAtlasHub/.github/.github/workflows/tagbot.yml@v1, secrets: inherit } }
+#   jobs: { tagbot: { uses: QAtlasHub/.github/.github/workflows/tagbot.yml@main, secrets: inherit } }
 name: TagBot (reusable)
 on:
   workflow_call:
     secrets:
+      # BOT_PAT was USED (`token:` below) and never declared. An undeclared secret in a called
+      # workflow is EMPTY unless the caller says `secrets: inherit` — the example above does, which is
+      # the only reason this ever worked and the reason nothing reported it. actionlint has been
+      # flagging it on every `push:main` run since at least 2026-07-26; pull requests passed because
+      # reviewdog only reports inside the diff, so a defect in an untouched file is invisible by
+      # construction on a PR. Same class as lab-sotashimozono/.github#17.
+      BOT_PAT:
+        required: false
       DOCUMENTER_KEY:
         required: false
 permissions: