diff --git a/.github/workflows/actions-pinned-check.yml b/.github/workflows/actions-pinned-check.yml
index 70c3aa5..3e1af7c 100644
--- a/.github/workflows/actions-pinned-check.yml
+++ b/.github/workflows/actions-pinned-check.yml
@@ -1,9 +1,14 @@
 ---
-# SEC-254: every `uses:` must reference an immutable 40-char commit SHA.
-# Mutable tags/branches do not pin — a compromised maintainer token can repoint
-# them at a malicious commit (CVE-2025-30066 hit 23k+ repos via tj-actions).
-# Deliberately implemented with shell only: the gate itself must not add a
-# third-party action dependency.
+# SEC-254: every third-party `uses:` must reference an immutable 40-char commit
+# SHA. Mutable tags/branches do not pin — a compromised maintainer token can
+# repoint them at a malicious commit (CVE-2025-30066 hit 23k+ repos via
+# tj-actions).
+#
+# Uses the shared iac gate via its composite action rather than the reusable-
+# workflow caller. The job MUST stay on opus-runner-standard: only that runner's
+# allow-listed IP can fetch the private opus-pro/iac action. A `workflow_call`
+# caller can't set runs-on, and its control-plane resolution can't reach iac
+# from this repo — hence the composite-action form here.
 name: actions-pinned-check
 on:
   pull_request:
@@ -22,20 +27,4 @@ jobs:
       - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - name: Fail on unpinned action refs
-        run: |
-          set -euo pipefail
-          bad=$(grep -rnE '^[[:space:]]*(-[[:space:]]+)?uses:' .github \
-                  --include='*.yml' --include='*.yaml' \
-                | sed 's/#.*//' \
-                | grep 'uses:' \
-                | grep -vE "uses:[[:space:]]*[\"']?\./" \
-                | grep -vE 'docker://[^[:space:]]+@sha256:' \
-                | grep -vE "@[0-9a-f]{40}[\"']?[[:space:]]*$" \
-                || true)
-          if [ -n "$bad" ]; then
-            echo "Unpinned action references (must be 40-char commit SHAs):"
-            echo "$bad"
-            exit 1
-          fi
-          echo "All action references are SHA-pinned."
+      - uses: opus-pro/iac/.github/actions/actions-pinned-check@main
diff --git a/.github/workflows/check-pr-basic.yml b/.github/workflows/check-pr-basic.yml
index 0ef97af..c5fd78d 100644
--- a/.github/workflows/check-pr-basic.yml
+++ b/.github/workflows/check-pr-basic.yml
@@ -22,4 +22,8 @@ jobs:
       - uses: thehanimo/pr-title-checker@1d8cd483a2b73118406a187f54dca8a9415f1375 # v1.4.2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          configuration_path: pull_request_title.json
\ No newline at end of file
+          # Read the config off the checkout, not the contents API: the org's IP
+          # allow list rejects API calls from GitHub-hosted runners ("your IP
+          # address is not permitted"), which failed this gate on every PR.
+          # LABEL.name is empty, so this is the action's only API call.
+          local_configuration_path: pull_request_title.json
\ No newline at end of file