diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9700c43..313d2e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -62,4 +62,8 @@ jobs:
           ACTIONLINT_VERSION=1.7.12
           curl -fsSL "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" \
             | tar -xz actionlint
-          ./actionlint -color
+          # `job_workflow_sha` is a valid GitHub context property (the reusable
+          # workflow's own commit) that actionlint 1.7.12's schema predates —
+          # ignore that one false positive; it's required for the cross-repo
+          # runner-helper checkout in scan.yml.
+          ./actionlint -color -ignore 'property "job_workflow_sha" is not defined'
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index c55bbe8..4df4bcb 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -343,7 +343,7 @@ jobs:
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: Sigilix/runner
-          ref: ${{ github.workflow_sha }}
+          ref: ${{ github.job_workflow_sha }}
           path: runner
           persist-credentials: false