diff --git a/docs/workflows/security.workstation.md b/docs/workflows/security.workstation.md
index 9c8a71c..6d924b5 100644
--- a/docs/workflows/security.workstation.md
+++ b/docs/workflows/security.workstation.md
@@ -124,7 +124,32 @@ done
 
 **Alert if**: High/critical CVEs in dependencies.
 
-### 4. Journal Suspicious Activity
+### 4. Semgrep SAST Scan
+
+```bash
+# Scan all repos for supply chain rules
+fd -t d -p '.git' ~/internal ~/external 2>/dev/null | while read gitdir; do
+  repo=$(dirname "$gitdir")
+  echo "=== $repo ==="
+  (cd "$repo" && semgrep --config p/supply-chain --config p/javascript --error 2>&1 | tail -5)
+done
+```
+
+**Alert if**: Findings in `eval`, `child_process`, `Buffer.from`, prototype pollution.
+
+### 5. SHA256 Package Verification
+
+```bash
+# Verify pacman package integrity against known-good hashes
+pacman -Qk 2>&1 | grep -v "0 modified files"
+
+# Check for package downgrade attacks
+pacman -Qi linux | grep -E "Install Date|Version"
+```
+
+**Alert if**: Modified files in package, unexpected version downgrade.
+
+### 6. Journal Suspicious Activity
 
 ```bash
 # Last 7 days: failed auth, suspicious exec, ptrace
@@ -201,7 +226,54 @@ ssh-add -l 2>/dev/null
 
 **Action**: Rotate any token older than 90 days. Enforce GAT scoping.
 
-### 5. Full SBOM Regenerate
+### OIDC & Token Best Practices
+
+| Practice | Implementation |
+|----------|---------------|
+| **OIDC over PAT** | Use `gh auth login` with browser flow, not personal access tokens |
+| **GAT scoping** | `gh auth refresh -s repo,read:packages` (minimum scopes) |
+| **npm OIDC** | Configure `npm-provenance` in CI, avoid `NPM_TOKEN` env vars |
+| **Short-lived tokens** | CI tokens max 1 hour TTL, no long-lived secrets in repos |
+| **Secret scanning** | Enable GitHub secret scanning + push protection |
+
+### 5. YARA Malware Pattern Scan
+
+```bash
+# Scan home directories with YARA rules (see source doc for rule files)
+yara -r /path/to/rules/malware.yar ~/internal ~/external 2>/dev/null
+
+# Quick inline check for known worm patterns
+grep -rl "pgmon\|uv-proxy\|pglog" ~/internal ~/external 2>/dev/null
+grep -rl "codePointAt.*0xFE00\|0xE0100" ~/internal ~/external 2>/dev/null
+```
+
+**Alert if**: Any YARA rule match = incident response protocol.
+
+### 6. Cosign Artifact Verification
+
+```bash
+# Verify container images before use (example)
+cosign verify --key cosign.pub ghcr.io/org/image:tag 2>/dev/null
+
+# Verify with OIDC keyless
+cosign verify --certificate-identity=*.satware.ai --certificate-oidc-issuer=https://token.actions.githubusercontent.com ghcr.io/org/image:tag 2>/dev/null
+```
+
+**Alert if**: Signature verification fails, do not use the artifact.
+
+### 7. Nuclei Network Template Scan
+
+```bash
+# Scan local services for known vulnerabilities
+nuclei -u http://localhost -t cves/ -severity high,critical -silent 2>/dev/null
+
+# Scan specific ports
+nuclei -u http://localhost:3000 -t exposures/ -silent 2>/dev/null
+```
+
+**Alert if**: High/critical template matches on local services.
+
+### 8. Full SBOM Regenerate
 
 ```bash
 # Regenerate SBOMs for all active projects
@@ -236,6 +308,75 @@ dmesg | grep -i "DMAR\|IOMMU" | head -3
 
 **Alert if**: Any parameter is 0/unset, unknown kernel modules loaded.
 
+## AppArmor/SELinux Status Check (Monthly)
+
+```bash
+# AppArmor (Arch default)
+sudo aa-status 2>/dev/null | head -20
+
+# Verify profiles are in enforce mode (not complain)
+sudo aa-status 2>/dev/null | grep -c "enforce"  # should be > 0
+sudo aa-status 2>/dev/null | grep "complain"     # should be empty
+
+# If using SELinux (alternative)
+getenforce 2>/dev/null  # expect: Enforcing
+sestatus 2>/dev/null
+```
+
+**Alert if**: No profiles loaded, profiles in complain mode, SELinux permissive.
+
+## Systemd Sandboxing Audit (Monthly)
+
+```bash
+# Check which services lack sandboxing directives
+for svc in $(systemctl list-units --type=service --state=running -q --no-pager | awk '{print $1}'); do
+  has_sandbox=$(systemctl show "$svc" --property=ProtectSystem,ProtectHome,PrivateTmp,NoNewPrivileges,ReadOnlyPaths 2>/dev/null | grep -v "^$" | wc -l)
+  if [ "$has_sandbox" -lt 3 ]; then
+    echo "WEAK_SANDBOX: $svc ($has_sandbox directives)"
+  fi
+done
+
+# Audit user services for sandboxing
+systemctl --user show '*.service' --property=ProtectSystem,ProtectHome,PrivateTmp 2>/dev/null | grep -B1 "^$"
+```
+
+**Alert if**: Critical services (docker, sshd, network) lack sandboxing directives. See source doc for per-service hardening.
+
+## Runtime Monitoring (Falco/eBPF) (Ongoing)
+
+```bash
+# Check Falco daemon status (if deployed)
+systemctl status falco 2>/dev/null | head -5
+
+# Review recent Falco alerts
+journalctl -u falco --since "7 days ago" --no-pager 2>/dev/null | grep -E "Warning|Critical"
+
+# Alternative: check Tetragon if deployed
+kubectl get events --field-selector type=Warning 2>/dev/null | tail -10
+```
+
+**Alert if**: Falco not running, high-severity alerts in logs. See source doc for Falco rules and Tetragon TracingPolicy YAML.
+
+## Memory Forensics (Incident Response Only)
+
+```bash
+# Create memory dump (requires elevated privileges)
+sudo dd if=/dev/mem of=/tmp/memdump.raw bs=1M count=1024 2>/dev/null
+
+# Analyze with Volatility 3
+uv tool install volatility3
+vol -f /tmp/memdump.raw linux.pslist 2>/dev/null
+vol -f /tmp/memdump.raw linux.bash 2>/dev/null
+
+# TeamPCP memory theft detection
+vol -f /tmp/memdump.raw linux.check_syscall 2>/dev/null
+
+# Cleanup
+rm -f /tmp/memdump.raw
+```
+
+**Use only**: During active incident investigation. Requires prior setup.
+
 ## Firewall Status Check (Weekly)
 
 ```bash
@@ -255,18 +396,46 @@ ss -tlnp | grep -E "LISTEN"
 
 **Alert if**: Default input policy is ACCEPT, unexpected listening ports, no firewall active.
 
+## Ansible Integration
+
+Persistent hardening changes go through `ansible/` per `.clinerules/workstation.md`.
+
+```bash
+# Verify current hardening state
+ansible-playbook ansible/workstation.yml --check
+
+# Apply hardening changes
+ansible-playbook ansible/workstation.yml
+```
+
+**Required Ansible tasks** (add to `ansible/roles/common/tasks/main.yml`):
+
+- Kernel sysctl parameters (kptr_restrict, dmesg_restrict, ASLR)
+- Firewall default policies (nftables DROP input)
+- AppArmor profile installation
+- Systemd sandboxing directives for critical services
+- `ignore-scripts: true` for npm config
+
+**Rule**: Never apply sysctl or firewall changes manually. Always via Ansible.
+
 ## Tool Installation (One-Time)
 
 ```bash
-# SBOM and vulnerability scanning
+# SBOM, vulnerability scanning, artifact verification, malware patterns
 pacman -S syft grype cosign yara
 
+# AppArmor user-space tools
+sudo pacman -S apparmor apparmor-profiles
+
 # SAST with supply chain rules
 uv tool install semgrep
 
 # Network template scanning
 go install -v github.com/projectdiscovery/nuclei/v3/cmd/nuclei@latest
 
+# Memory forensics (incident response)
+uv tool install volatility3
+
 # npm package risk scoring
 npm install -g socket-cli
 ```