diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
index 4db4187..d8a5602 100644
--- a/.github/workflows/pr-build.yml
+++ b/.github/workflows/pr-build.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: Bespok3d/b3-builder@main
+      - uses: Bespok3d/b3-builder@76d815a56dc5708b3d0c3a587fc2b027deca4640  # main @ 2026-07-21
         with:
           unit: repo
           bake: 'true'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 604eab8..d51b95a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,13 +27,16 @@ jobs:
         with:
           fetch-depth: 0   # full history so the index.json push can rebase on a concurrent update
 
-      - uses: Bespok3d/b3-builder@main
+      - uses: Bespok3d/b3-builder@76d815a56dc5708b3d0c3a587fc2b027deca4640  # main @ 2026-07-21
         with:
           unit: repo
+          # Per-repo Actions secret today (GitHub Free cannot org-secret private repos); becomes ONE org
+          # secret every repo inherits when the repos go public. See b3-builder README (secrets model).
+          signing-key: ${{ secrets.REGISTRY_SIGNING_KEY }}
           bake: 'true'
           atom-repo: ${{ github.repository }}
           list-name: 'Reference Python Plugins'
-          list-publisher: 'PLACEHOLDER'
+          list-publisher: '679939555819fb5f6423dc68c4388e76bfa9b4e0'
           list-ref-name: 'Reference Python Plugins'
           main-index-repo: Bespok3d/main-index
           # Per-repo Actions secret today (GitHub Free cannot org-secret private repos); becomes ONE org