diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 0e3afebd..f99ca504 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -6,6 +6,8 @@ on:
     branches:
       - amo
 
+permissions: {}
+
 jobs:
   test:
     env:
diff --git a/.github/workflows/python.yaml b/.github/workflows/python.yaml
index 66b5fa5f..598dcbea 100644
--- a/.github/workflows/python.yaml
+++ b/.github/workflows/python.yaml
@@ -20,6 +20,8 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+      with:
+        persist-credentials: false
     - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
       with:
         python-version: ${{ matrix.python-version }}
diff --git a/.github/workflows/sync_upstream.yaml b/.github/workflows/sync_upstream.yaml
index 321a06ee..ddb10a5b 100644
--- a/.github/workflows/sync_upstream.yaml
+++ b/.github/workflows/sync_upstream.yaml
@@ -17,7 +17,7 @@ jobs:
       issues: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           ref: amo
           fetch-depth: 0
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..c59f0b8a
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: Zizmor
+
+on:
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        with:
+          persist-credentials: false
+
+      - name: Install zizmor
+        run: pip install zizmor==1.22.0
+
+      - name: Run zizmor
+        run: zizmor .github/workflows/
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}