diff --git a/docs/guides/WORKFLOW_QUICK_REF.md b/docs/guides/WORKFLOW_QUICK_REF.md
new file mode 100644
index 000000000..8f6cfaba2
--- /dev/null
+++ b/docs/guides/WORKFLOW_QUICK_REF.md
@@ -0,0 +1,90 @@
+# Workflow Simulation - Quick Reference
+
+## Commands
+
+### Validation (No dependencies required)
+```bash
+npm run act:validate           # Validate all workflow files
+```
+
+### Simulation (No Docker required)
+```bash
+npm run simulate:lint          # Simulate lint job
+npm run simulate:build         # Simulate build job
+npm run simulate:all           # Simulate all jobs
+```
+
+### Diagnostics
+```bash
+npm run act:diagnose           # Check setup and validate workflows
+```
+
+### With act (requires act + Docker)
+```bash
+npm run act:lint               # Run lint in Docker
+npm run act:build              # Run build in Docker
+npm run act:all                # Run full CI in Docker
+```
+
+## What Each Tool Does
+
+| Tool | Purpose | Requirements | When to Use |
+|------|---------|--------------|-------------|
+| `act:validate` | Check YAML syntax & structure | Python 3 | Before commit |
+| `simulate:*` | Run commands locally | Node.js/Bun | Quick checks |
+| `act:diagnose` | Check setup & validate | Python 3 | Troubleshooting |
+| `act:*` | Run in Docker container | act + Docker | Full simulation |
+
+## Workflow Files Fixed
+
+All workflow path references updated from `ci.yml` to `ci/ci.yml`:
+- ✅ package.json scripts
+- ✅ run-act.sh default path
+- ✅ diagnose-workflows.sh
+- ✅ test-workflows.sh
+
+## Security Improvements
+
+- ✅ Pinned all GitHub Actions to specific commit SHAs
+- ✅ Fixed unpinned `dependency-check/Dependency-Check_Action@main`
+- ✅ Validation script warns about unpinned actions
+
+## New Files
+
+1. `validate-workflows.py` - Workflow validation without act
+2. `simulate-workflows.sh` - Local job simulation
+3. `docs/guides/WORKFLOW_SIMULATION.md` - Full documentation
+
+## Common Use Cases
+
+### Before Committing
+```bash
+npm run act:validate
+```
+
+### Quick Local Check
+```bash
+npm run simulate:lint
+```
+
+### Full Local CI Run
+```bash
+npm run simulate:all
+```
+
+### With Docker (if act installed)
+```bash
+npm run act:all
+```
+
+## Exit Codes
+
+- `0` - Success
+- `1` - Validation/execution failed
+
+## Tips
+
+- Use `simulate:*` for fast iteration
+- Use `act:*` for exact GitHub environment
+- Run `act:validate` in CI/pre-commit hooks
+- Check `docs/guides/WORKFLOW_SIMULATION.md` for details
diff --git a/frontends/nextjs/scripts/diagnose-workflows.sh b/frontends/nextjs/scripts/diagnose-workflows.sh
index e0f131d80..e5231c075 100755
--- a/frontends/nextjs/scripts/diagnose-workflows.sh
+++ b/frontends/nextjs/scripts/diagnose-workflows.sh
@@ -13,25 +13,27 @@ echo
 # Check if act is installed
 echo "📦 Checking act installation..."
 if ! command -v act &> /dev/null; then
-    echo "❌ act is not installed"
+    echo "⚠️  act is not installed (optional)"
     echo "   Install with: brew install act"
-    exit 1
+    ACT_AVAILABLE=false
+else
+    echo "✅ act version: $(act --version)"
+    ACT_AVAILABLE=true
 fi
-echo "✅ act version: $(act --version)"
 echo
 
-# Check Docker
-echo "🐳 Checking Docker..."
-if ! command -v docker &> /dev/null; then
-    echo "❌ Docker is not installed"
-    exit 1
+# Check Docker only if act is available
+if [ "$ACT_AVAILABLE" = true ]; then
+    echo "🐳 Checking Docker..."
+    if ! command -v docker &> /dev/null; then
+        echo "⚠️  Docker is not installed (optional for act)"
+    elif ! docker info &> /dev/null; then
+        echo "⚠️  Docker daemon is not running (optional for act)"
+    else
+        echo "✅ Docker is running"
+    fi
+    echo
 fi
-if ! docker info &> /dev/null; then
-    echo "❌ Docker daemon is not running"
-    exit 1
-fi
-echo "✅ Docker is running"
-echo
 
 # List workflows
 echo "📋 Available workflows in $PROJECT_ROOT/.github/workflows:"
@@ -46,13 +48,15 @@ fi
 echo
 
 # List jobs in main CI workflow
-echo "🏗️  Jobs in ci/ci.yml:"
-if [ -f "$PROJECT_ROOT/.github/workflows/ci/ci.yml" ]; then
-    act -l -W "$PROJECT_ROOT/.github/workflows/ci/ci.yml" 2>/dev/null || echo "   (Failed to parse workflow)"
-else
-    echo "❌ ci/ci.yml not found"
+if [ "$ACT_AVAILABLE" = true ]; then
+    echo "🏗️  Jobs in ci/ci.yml:"
+    if [ -f "$PROJECT_ROOT/.github/workflows/ci/ci.yml" ]; then
+        act -l -W "$PROJECT_ROOT/.github/workflows/ci/ci.yml" 2>/dev/null || echo "   (Failed to parse workflow)"
+    else
+        echo "❌ ci/ci.yml not found"
+    fi
+    echo
 fi
-echo
 
 # Check for .actrc or .secrets
 echo "🔐 Checking for act configuration..."
diff --git a/frontends/nextjs/scripts/simulate-workflows.sh b/frontends/nextjs/scripts/simulate-workflows.sh
index aa8b09e13..240f4c8ed 100755
--- a/frontends/nextjs/scripts/simulate-workflows.sh
+++ b/frontends/nextjs/scripts/simulate-workflows.sh
@@ -27,7 +27,7 @@ simulate_job() {
             if command -v bun &> /dev/null; then
                 bun install
             else
-                npm ci || npm install
+                npm install
             fi
             echo
             echo "🗄️  Generating Prisma Client..."
@@ -42,7 +42,7 @@ simulate_job() {
             if command -v bun &> /dev/null; then
                 bun install
             else
-                npm ci || npm install
+                npm install
             fi
             echo
             echo "🗄️  Generating Prisma Client..."
@@ -57,7 +57,7 @@ simulate_job() {
             if command -v bun &> /dev/null; then
                 bun install
             else
-                npm ci || npm install
+                npm install
             fi
             echo
             echo "🗄️  Generating Prisma Client..."
@@ -72,7 +72,7 @@ simulate_job() {
             if command -v bun &> /dev/null; then
                 bun install
             else
-                npm ci || npm install
+                npm install
             fi
             echo
             echo "🗄️  Generating Prisma Client..."
@@ -87,7 +87,7 @@ simulate_job() {
             if command -v bun &> /dev/null; then
                 bun install
             else
-                npm ci || npm install
+                npm install
             fi
             echo
             echo "🗄️  Generating Prisma Client..."
@@ -102,7 +102,7 @@ simulate_job() {
             if command -v bun &> /dev/null; then
                 bun install
             else
-                npm ci || npm install
+                npm install
             fi
             echo
             echo "🗄️  Generating Prisma Client..."