diff --git a/README.md b/README.md
index ac96bee..336396c 100644
--- a/README.md
+++ b/README.md
@@ -27,8 +27,6 @@ No modules.
 | [github_repository.repositories](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository) | resource |
 | [github_repository_file.dependabot](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
 | [github_repository_file.dependabot_notify](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
-| [github_repository_file.license](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
-| [github_repository_file.opentofu_workflow](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/repository_file) | resource |
 | [github_team.admins](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
 | [github_team.developers](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team) | resource |
 | [github_team_membership.admins_xnoto](https://registry.terraform.io/providers/integrations/github/latest/docs/resources/team_membership) | resource |
diff --git a/gh-managed-files.tf b/gh-managed-files.tf
deleted file mode 100644
index 976fd3d..0000000
--- a/gh-managed-files.tf
+++ /dev/null
@@ -1,173 +0,0 @@
-# Reusable OpenTofu callers and GPLv3 licenses are managed centrally here.
-# Do not add hand-maintained copies to the target repositories.
-#
-# The caller map contains only roots using the shared OpenTofu workflow.
-# terraform-libvirt-domain has distinct CI, and tfroot-namecheap has no branch
-# yet, so neither can safely receive this caller file.
-locals {
-  managed_opentofu_workflows = {
-    "tfroot-aws"        = <<-EOT
-      # Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
-      name: opentofu
-
-      on:
-        pull_request:
-          branches:
-            - main
-        push:
-          branches:
-            - main
-
-      permissions:
-        contents: write
-        id-token: write
-        pull-requests: write
-
-      jobs:
-        opentofu:
-          # Fork PRs do not run infrastructure-aware OpenTofu jobs.
-          if: >-
-            github.event_name != 'pull_request' ||
-            github.event.pull_request.head.repo.full_name == github.repository
-          uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
-    EOT
-    "tfroot-cloudflare" = <<-EOT
-      # Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
-      name: opentofu
-
-      on:
-        pull_request:
-          branches:
-            - main
-        push:
-          branches:
-            - main
-
-      permissions:
-        contents: write
-        id-token: write
-        pull-requests: write
-
-      jobs:
-        opentofu:
-          # Fork PRs do not run infrastructure-aware OpenTofu jobs.
-          if: >-
-            github.event_name != 'pull_request' ||
-            github.event.pull_request.head.repo.full_name == github.repository
-          uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
-    EOT
-    "tfroot-gcp"        = <<-EOT
-      # Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
-      name: opentofu
-
-      on:
-        pull_request:
-          branches:
-            - main
-        push:
-          branches:
-            - main
-
-      permissions:
-        contents: write
-        id-token: write
-        pull-requests: write
-
-      jobs:
-        opentofu:
-          # Fork PRs do not run infrastructure-aware OpenTofu jobs.
-          if: >-
-            github.event_name != 'pull_request' ||
-            github.event.pull_request.head.repo.full_name == github.repository
-          uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
-          with:
-            gcp-workload-identity-provider: projects/920734942788/locations/global/workloadIdentityPools/github/providers/github
-            gcp-service-account: terraformer@makeitworkcloud.iam.gserviceaccount.com
-    EOT
-    "tfroot-github"     = <<-EOT
-      # Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
-      name: opentofu
-
-      on:
-        pull_request:
-          branches:
-            - main
-        push:
-          branches:
-            - main
-
-      permissions:
-        contents: write
-        id-token: write
-        pull-requests: write
-
-      jobs:
-        opentofu:
-          # Fork PRs do not run infrastructure-aware OpenTofu jobs.
-          if: >-
-            github.event_name != 'pull_request' ||
-            github.event.pull_request.head.repo.full_name == github.repository
-          uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
-    EOT
-    "tfroot-libvirt"    = <<-EOT
-      # Managed by tfroot-github (gh-managed-files.tf); local edits are overwritten.
-      name: opentofu
-
-      on:
-        pull_request:
-          branches:
-            - main
-        push:
-          branches:
-            - main
-
-      permissions:
-        contents: write
-        id-token: write
-        pull-requests: write
-
-      jobs:
-        opentofu:
-          # Fork PRs do not run infrastructure-aware OpenTofu jobs.
-          if: >-
-            github.event_name != 'pull_request' ||
-            github.event.pull_request.head.repo.full_name == github.repository
-          uses: makeitworkcloud/shared-workflows/.github/workflows/opentofu.yml@main
-          with:
-            # Native tfroot-runner scale set in kustomize-cluster/workloads/arc.
-            # The runner pod IS the tfroot-runner image — no nested container.
-            runs-on: arc-tf
-            setup-ssh: true
-          secrets:
-            SSH_PRIVATE_KEY: $${{ secrets.SSH_PRIVATE_KEY }}
-            SSH_KNOWN_HOSTS: $${{ secrets.SSH_KNOWN_HOSTS }}
-    EOT
-  }
-
-  # tfroot-namecheap is intentionally excluded until it has a default branch;
-  # github_repository_file cannot create a file on an absent branch.
-  managed_license_repositories = setsubtract(
-    local.active_github_repositories,
-    toset(["tfroot-namecheap"])
-  )
-}
-
-resource "github_repository_file" "opentofu_workflow" {
-  for_each = local.managed_opentofu_workflows
-
-  repository          = github_repository.repositories[each.key].name
-  file                = ".github/workflows/opentofu.yml"
-  content             = each.value
-  commit_message      = "chore: sync managed OpenTofu workflow"
-  overwrite_on_create = true
-}
-
-resource "github_repository_file" "license" {
-  for_each = local.managed_license_repositories
-
-  repository          = github_repository.repositories[each.key].name
-  file                = "LICENSE"
-  content             = file("${path.module}/LICENSE")
-  commit_message      = "chore: sync GPLv3 license"
-  overwrite_on_create = true
-}