diff --git a/.github/workflows/zz-one-off-lock-regen.yml b/.github/workflows/zz-one-off-lock-regen.yml
new file mode 100644
index 00000000..a66359d9
--- /dev/null
+++ b/.github/workflows/zz-one-off-lock-regen.yml
@@ -0,0 +1,55 @@
+# SPDX-License-Identifier: MPL-2.0
+# ONE-OFF, scratch branch only, deleted after use. Regenerates panic-attack's fix branch's
+# actions.lock with the estate repair order (regen_lock in
+# standards/scripts/regen-dependabot-locks.sh), runs the governance gate's own
+# check against the result, and prints the lock base64-encoded. It has no
+# `uses:` steps, so it needs no lock entry to start. It writes nothing back:
+# the lock reaches the repository in a reviewed PR.
+name: one-off actions.lock regeneration
+on:
+  push:
+    branches: [claude/new-session-th4e9w-lockregen]
+permissions:
+  contents: read
+jobs:
+  regen:
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    env:
+      GH_TOKEN: ${{ github.token }}
+      REPO: hyperpolymath/panic-attack
+      STANDARDS_REGEN_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
+      STANDARDS_GATE_SHA: 333b06a01db1874ffedb2de1bfabb195640927c7
+    steps:
+      - name: Regenerate the repair branch's actions.lock and check it with the gate
+        run: |
+          set -uo pipefail
+          git clone --quiet --branch claude/new-session-th4e9w https://github.com/hyperpolymath/panic-attack.git pb
+          git -C pb log --oneline -1
+          git clone --quiet https://github.com/hyperpolymath/standards.git std
+          git -C std worktree add --quiet --detach ../std-regen "$STANDARDS_REGEN_SHA"
+          git -C std worktree add --quiet --detach ../std-gate "$STANDARDS_GATE_SHA"
+          sudo apt-get install -y -qq gawk >/dev/null
+          gh extension install github/gh-actions-lock --pin v0.2.0
+          gh actions-lock --version
+          # Full estate regen (gh actions-lock first, which also migrates the
+          # format to v0.0.3, then the repair chain).
+          export GH_BIN=gh REGEN_TOOLS="$PWD/std-regen/scripts"
+          # Start from no lock: main's pins v1 at a commit the tag no longer
+          # names, which gh actions-lock rejects as a conflicting target.
+          rm -f pb/.github/workflows/actions.lock
+          (cd pb && { gh actions-lock >&2 || echo "seed gh actions-lock RC=$?"; })
+          test -f pb/.github/workflows/actions.lock && echo SEEDED
+          source std-regen/scripts/regen-dependabot-locks.sh
+          outcome="$(regen_lock "$PWD/pb" || true)"
+          echo "OUTCOME=$outcome"
+          (cd pb && { bash ../std-regen/scripts/check-lock-sync.sh .github/workflows && echo "SYNC RC=0" || echo "SYNC RC=$?"; })
+          head -5 pb/.github/workflows/actions.lock
+          git -C pb status --porcelain
+          echo "== the governance gate, as pinned by the repair branch ($STANDARDS_GATE_SHA)"
+          (cd pb && ACTIONS_LOCK_VERIFIER="$PWD/../std-gate/scripts/update-actions-lock.sh" \
+            bash ../std-gate/scripts/check-actions-lock-gate.sh .github/workflows); echo "GATE_RC=$?"
+          echo "LOCK-SHA256 $(sha256sum < pb/.github/workflows/actions.lock | cut -d' ' -f1)"
+          echo "LOCK-BEGIN"
+          cat pb/.github/workflows/actions.lock
+          echo "LOCK-END"