@@ -45,18 +45,11 @@ jobs:
     outputs:
       docs_only: ${{ steps.filter.outputs.docs_only }}
     steps:
-      # Stage 1 of the harden-runner egress rollout: `git fetch`/`git diff`
-      # against the checked-out repo and no other tool download, so
-      # github.com/actions endpoints are the entire footprint — identical to
-      # the "Commit Message" job below, which already runs block mode with
-      # this endpoint set for the same fetch-depth-0-then-read-history shape.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -156,49 +149,17 @@ jobs:
       lint-check-name: Go Lint
       test-check-name: Go Test
       run-workflow-security: true
-      # Stage 1 of the harden-runner egress rollout (see quality-*/security-*
-      # workflows for the rest of stage 1): zizmor only talks to ghcr.io for
-      # its own container image plus github.com/pkg-containers for the pull —
-      # same endpoint set drydock's own security-actions job (ci-verify.yml)
-      # uses for this identical CodesWhat/.github go-ci.yml workflow-security
-      # job, so this follows established org precedent rather than a guess.
-      workflow-security-egress-policy: block
-      workflow-security-allowed-endpoints: "ghcr.io:443 github.com:443 pkg-containers.githubusercontent.com:443"
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
+      workflow-security-egress-policy: audit
       run-goreleaser: ${{ github.event_name != 'schedule' }}
       # Repository-run Qlty gate ("Go CI / Qlty Check"), which needs no Qlty
       # Cloud account. Distinct from the Qlty Cloud GitHub App's own statuses
       # (`qlty check`, `qlty coverage`, `qlty coverage diff`), which fail
       # org-wide on billing minutes and are never required contexts. Skipped on
       # the weekly schedule alongside GoReleaser, matching portwing.
       run-qlty: ${{ github.event_name != 'schedule' }}
-      # Copied verbatim from portwing's proven allowlist rather than
-      # re-derived: qlty downloads its own CLI and every plugin runtime it
-      # resolves (node, python, go, java) on a cold runner, so a narrower list
-      # fails on whichever plugin the default source adds next.
-      qlty-egress-policy: block
-      qlty-allowed-endpoints: >-
-        api.github.com:443
-        api.osv.dev:443
-        api.segment.io:443
-        api0.prismacloud.io:443
-        dl.google.com:443
-        files.pythonhosted.org:443
-        github-proxy.qlty.sh:443
-        github.com:443
-        go.dev:443
-        mirror.gcr.io:443
-        nodejs.org:443
-        objects.githubusercontent.com:443
-        proxy.golang.org:443
-        pypi.org:443
-        qlty-releases.s3.amazonaws.com:443
-        radarlint-releases.s3.amazonaws.com:443
-        registry.npmjs.org:443
-        release-assets.githubusercontent.com:443
-        sum.golang.org:443
-        tmaproduction.blob.core.windows.net:443
-        tuf-repo-cdn.sigstore.dev:443
-        tuf-repo.github.com:443
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
+      qlty-egress-policy: audit
       # An empty list produces no matrix jobs at all: go-ci.yml's fuzz job
       # is gated on `fromJSON(inputs.fuzzers-json)[0] != null`. On a
       # docs-only PR that is 29 jobs and ~67 runner-minutes not spent
@@ -232,16 +193,11 @@ jobs:
       contents: read
 
     steps:
-      # Stage 1 of the harden-runner egress rollout: shellcheck is
-      # runner-image-preinstalled (no tool download) and only checks out the
-      # repo, so github.com/actions endpoints are the entire footprint.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -311,19 +267,11 @@ jobs:
       contents: read
 
     steps:
-      # Stage 1 of the harden-runner egress rollout: same job, same tool,
-      # and the same endpoint set (including api.deps.dev for
-      # dependency-review-action's changed-package metadata lookup) drydock
-      # already runs in block mode for this identical job.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            api.deps.dev:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -351,19 +299,11 @@ jobs:
       GITLEAKS_LINUX_X64_SHA256: "551f6fc83ea457d62a0d98237cbad105af8d557003051f41f3e7ca7b3f2470eb"
 
     steps:
-      # Stage 1 of the harden-runner egress rollout: same "download a GitHub
-      # release tarball, verify its checksum, run it" shape as drydock's own
-      # "secrets" job, so this reuses drydock's exact block-mode endpoint set
-      # for that pattern.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -416,16 +356,11 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      # Stage 1 of the harden-runner egress rollout: pure `git log` against
-      # the checked-out repo, no other tool download — github.com/actions
-      # endpoints are the entire footprint.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
 
@@ -54,17 +54,11 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      # Stage 1 of the harden-runner egress rollout: the only external call
-      # this job makes is curl against docs.docker.com — a single, stable
-      # vendor host.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            docs.docker.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
 
@@ -33,22 +33,11 @@ jobs:
     # ~13m; this budget adds headroom for slower/shared CI hardware.
     timeout-minutes: 40
     steps:
-      # Stage 1 of the harden-runner egress rollout: pure Go build/bench, no
-      # Docker. Same endpoint set as quality-fuzz-nightly.yml — see that
-      # file's comment for the reasoning on each host.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
-            proxy.golang.org:443
-            storage.googleapis.com:443
-            sum.golang.org:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
 
@@ -50,9 +50,7 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -97,8 +95,7 @@ jobs:
       # leg ran 47 minutes green under audit on 2026-08-01 (run 30692172568),
       # quality-fuzz-monthly.yml already runs audit for its 61-minute legs,
       # and no job in this repo has survived past 16.5 minutes under block.
-      # This job holds contents: read and no persisted credential; the
-      # write-capable update-badge job stays on block.
+      # This job holds contents: read and no persisted credential.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
@@ -184,16 +181,11 @@ jobs:
       lived: ${{ steps.score.outputs.lived }}
       reports_found: ${{ steps.score.outputs.reports_found }}
     steps:
-      # Stage 1 of the harden-runner egress rollout: only downloads
-      # artifacts — all GitHub-internal traffic.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Download all package reports
@@ -405,13 +397,11 @@ jobs:
     permissions:
       contents: write  # commit the badge JSON back with GITHUB_TOKEN
     steps:
-      # Pushes one commit back to origin — GitHub-internal traffic only.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
 
@@ -58,15 +58,11 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      # Stage 1 of the harden-runner egress rollout: no Docker in this leg,
-      # just the route-normalizer self-test against the checked-out repo.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -162,16 +158,11 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      # Stage 1 of the harden-runner egress rollout: only downloads
-      # artifacts and aggregates JSON locally — all GitHub-internal traffic,
-      # no checkout even needed.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Download all row artifacts
 
@@ -105,29 +105,11 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
-      # Stage 1 of the harden-runner egress rollout: pure Go, no Docker.
-      # Same base endpoints as quality-fuzz-nightly.yml plus vuln.go.dev for
-      # govulncheck's own vulnerability database fetch.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
-            proxy.golang.org:443
-            storage.googleapis.com:443
-            sum.golang.org:443
-            vuln.go.dev:443
-            # setup-go resolves go.mod's version against actions/go-versions
-            # first, then falls back to go.dev/dl/?mode=json. Warm runners hit
-            # the manifest and never touch go.dev, so leaving this out passes
-            # until the day the toolchain isn't cached and the job dies with
-            # no related change.
-            go.dev:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -250,23 +232,11 @@ jobs:
       contents: read
       security-events: write
     steps:
-      # Stage 1 of the harden-runner egress rollout: static scan of the
-      # checked-out repo, no Docker build. Same endpoint set drydock already
-      # runs in block mode for its own (npm-only) grype-deps job — this
-      # extends it to the identical Go+npm scan sockguard runs.
+      # Audit mode: block mode intermittently refused allow-listed hosts on hosted runners (DEP-19). Release workflows keep block.
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            release-assets.githubusercontent.com:443
-            get.anchore.io:443
-            grype.anchore.io:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
           disable-sudo: true
 
       - name: Checkout
@@ -453,11 +423,7 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25  # v2.22.1
         with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            *.actions.githubusercontent.com:443
+          egress-policy: audit
 
       - name: Resolve latest published, non-prerelease tag
         id: latest_release
 
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+
+- CI, PR security scans and quality workflows run harden-runner in audit mode because block mode intermittently refused allow-listed hosts and left jobs hanging until their timeout; the release cut and publisher keep block mode with their curated allow lists.
+
 ## [2.3.0-rc.9] - 2026-10-25
 
 ### Security