diff --git a/workflow-templates/node-ci.yml b/workflow-templates/node-ci.yml
index a4bf4bd..c46fec6 100644
--- a/workflow-templates/node-ci.yml
+++ b/workflow-templates/node-ci.yml
@@ -27,21 +27,21 @@ jobs:
     # secrets:
     #   CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}  # needed only with coverage-file
     # with:
-      # Node.js
-      # node-version-file: .nvmrc                     # e.g. frontend/.nvmrc, package.json
-      # node-version: ''                              # e.g. '22', 'lts/*' (takes precedence over node-version-file)
-      # working-directory: .                          # e.g. frontend, apps/web
+    #   # Node.js
+    #   node-version-file: .nvmrc                     # e.g. frontend/.nvmrc, package.json
+    #   node-version: ''                              # e.g. '22', 'lts/*' (takes precedence over node-version-file)
+    #   working-directory: .                          # e.g. frontend, apps/web
 
-      # Static checks ('' = npm `check`/`lint` and `types`/`type-check` scripts)
-      # lint-command: ''                              # e.g. npm run lint -- --max-warnings=0
-      # types-command: ''                             # e.g. npx vue-tsc --noEmit
+    #   # Static checks ('' = npm `check`/`lint` and `types`/`type-check` scripts)
+    #   lint-command: ''                              # e.g. npm run lint -- --max-warnings=0
+    #   types-command: ''                             # e.g. npx vue-tsc --noEmit
 
-      # Tests and build ('' = npm `test` script)
-      # test-command: ''                              # e.g. npx vitest run --coverage --coverage.reporter=lcov
-      # coverage-file: ''                             # e.g. coverage/lcov.info (turns on the Codecov upload)
-      # build-command: npm run build                  # e.g. npm run build -- --mode staging
+    #   # Tests and build ('' = npm `test` script)
+    #   test-command: ''                              # e.g. npx vitest run --coverage --coverage.reporter=lcov
+    #   coverage-file: ''                             # e.g. coverage/lcov.info (turns on the Codecov upload)
+    #   build-command: npm run build                  # e.g. npm run build -- --mode staging
 
-      # Browser tests
-      # browser-tests: false                          # true: run the Playwright job
-      # browser-test-command: npx playwright test     # e.g. npm run test:e2e
-      # playwright-browsers: chromium                 # e.g. chromium firefox webkit
+    #   # Browser tests
+    #   browser-tests: false                          # true: run the Playwright job
+    #   browser-test-command: npx playwright test     # e.g. npm run test:e2e
+    #   playwright-browsers: chromium                 # e.g. chromium firefox webkit
diff --git a/workflow-templates/security.yml b/workflow-templates/security.yml
index 693351c..99c1149 100644
--- a/workflow-templates/security.yml
+++ b/workflow-templates/security.yml
@@ -20,11 +20,11 @@ jobs:
   security:
     uses: scify/.github/.github/workflows/security.yml@v0.1
     # with:
-      # working-directory: .                          # e.g. frontend (the folder with package.json)
-      # php-version: '8.4'                            # e.g. '8.3' (runs composer audit)
-      # composer-abandoned: report                    # e.g. fail, ignore
-      # npm-audit-level: high                         # e.g. moderate, critical
-      # npm-min-release-age: '7'                      # e.g. '14' (days, 7 or more)
-      # gitleaks-full-history: false                  # true: pull requests scan the full history too
-      # strict-dev-configs: false                     # true: fail on suspicious commands in dev tool configs
-      # allowed-dev-scripts: ''                       # e.g. .claude/hooks/*.sh (one glob per line)
+    #   working-directory: .                          # e.g. frontend (the folder with package.json)
+    #   php-version: '8.4'                            # e.g. '8.3' (runs composer audit)
+    #   composer-abandoned: report                    # e.g. fail, ignore
+    #   npm-audit-level: high                         # e.g. moderate, critical
+    #   npm-min-release-age: '7'                      # e.g. '14' (days, 7 or more)
+    #   gitleaks-full-history: false                  # true: pull requests scan the full history too
+    #   strict-dev-configs: false                     # true: fail on suspicious commands in dev tool configs
+    #   allowed-dev-scripts: ''                       # e.g. .claude/hooks/*.sh (one glob per line)