diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index bf0b99a..1e96dec 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -16,6 +16,7 @@ permissions:
     contents: read
     security-events: write
     actions: read
+    checks: write
 
 env:
     CARGO_TERM_COLOR: always
@@ -23,13 +24,14 @@ env:
 jobs:
     audit:
         name: Security Audit
-        uses: ./.github/workflows/rust-reusable.yml
-        with:
-            timeout_minutes: 20
-            toolchain: stable
-            run_command: |
-                cargo install --locked cargo-audit --version 0.22.1
-                cargo audit
+        runs-on: blacksmith-2vcpu-ubuntu-2404
+        timeout-minutes: 20
+        steps:
+            - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+
+            - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
+              with:
+                  token: ${{ secrets.GITHUB_TOKEN }}
 
     deny:
         name: License & Supply Chain
diff --git a/docs/actions-source-policy.md b/docs/actions-source-policy.md
index 21eb6e2..026bfe2 100644
--- a/docs/actions-source-policy.md
+++ b/docs/actions-source-policy.md
@@ -19,6 +19,7 @@ Selected allowlist patterns:
 - `DavidAnson/markdownlint-cli2-action@*`
 - `lycheeverse/lychee-action@*`
 - `EmbarkStudios/cargo-deny-action@*`
+- `rustsec/audit-check@*`
 - `rhysd/actionlint@*`
 - `softprops/action-gh-release@*`
 - `sigstore/cosign-installer@*`
@@ -79,6 +80,10 @@ Latest sweep notes:
 - 2026-02-16: Blacksmith migration blocked workflow execution
     - Added allowlist pattern: `useblacksmith/*` for self-hosted runner infrastructure
     - Actions: `useblacksmith/setup-docker-builder@v1`, `useblacksmith/build-push-action@v2`
+- 2026-02-17: Security audit reproducibility/freshness balance update
+    - Added allowlist pattern: `rustsec/audit-check@*`
+    - Replaced inline `cargo install cargo-audit` execution with pinned `rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998` in `security.yml`
+    - Supersedes floating-version proposal in #588 while keeping action source policy explicit
 
 ## Rollback
 
diff --git a/docs/ci-map.md b/docs/ci-map.md
index 344ed6f..d2a47dc 100644
--- a/docs/ci-map.md
+++ b/docs/ci-map.md
@@ -24,7 +24,7 @@ Merge-blocking checks should stay small and deterministic. Optional checks are u
 - `.github/workflows/docker.yml` (`Docker`)
     - Purpose: PR docker smoke check and publish images on `main`/tag pushes
 - `.github/workflows/security.yml` (`Security Audit`)
-    - Purpose: dependency advisories (`cargo audit`) and policy/license checks (`cargo deny`)
+    - Purpose: dependency advisories (`rustsec/audit-check`, pinned SHA) and policy/license checks (`cargo deny`)
 - `.github/workflows/release.yml` (`Release`)
     - Purpose: build tagged release artifacts and publish GitHub releases
 - `.github/workflows/label-policy-sanity.yml` (`Label Policy Sanity`)