diff --git a/.github/workflows/actions-static-analysis.yml b/.github/workflows/actions-static-analysis.yml
new file mode 100644
index 00000000..ebefdcec
--- /dev/null
+++ b/.github/workflows/actions-static-analysis.yml
@@ -0,0 +1,35 @@
+---
+name: GitHub Actions Static Analysis
+
+on:
+  push:
+    branches:
+    - "main"
+    paths:
+    - ".github/workflows/**"
+  pull_request:
+    paths:
+    - ".github/workflows/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1   # v7.0.1
+      with:
+        persist-credentials: false
+
+    - name: Run zizmor 🌈
+      uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054   # v0.6.2
+      with:
+        inputs: ".github/workflows/"
+        min-severity: medium
+        min-confidence: medium
+        advanced-security: false
diff --git a/.github/workflows/canary.yml b/.github/workflows/canary.yml
index 1f813d09..ee6c4f95 100644
--- a/.github/workflows/canary.yml
+++ b/.github/workflows/canary.yml
@@ -98,7 +98,9 @@ jobs:
         cell: ${{ fromJSON(needs.enumerate.outputs.cells) }}
     name: build ${{ matrix.cell }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     # Installs the CLI and starts an engine that pulls Docker Hub images
     # through a caching mirror; see the action for why.
     - uses: ./.github/actions/dagger-engine
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 27b7017e..ba9cb9c4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,8 +12,12 @@ concurrency:
 jobs:
   fast-checks:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         enable-cache: true
diff --git a/.github/workflows/plugin-compat.yml b/.github/workflows/plugin-compat.yml
index f801f966..25697c68 100644
--- a/.github/workflows/plugin-compat.yml
+++ b/.github/workflows/plugin-compat.yml
@@ -46,10 +46,11 @@ jobs:
       any: ${{ steps.matrix.outputs.any }}
       cells: ${{ steps.matrix.outputs.cells }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         # Full history so the PR base is available to diff against.
         fetch-depth: 0
+        persist-credentials: false
     - uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
       with:
         enable-cache: true
@@ -97,7 +98,9 @@ jobs:
     name: ${{ matrix.cell.group }}/${{ matrix.cell.release }}/${{ matrix.cell.deployment
       }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     # Installs the CLI and starts an engine that pulls Docker Hub images
     # through a caching mirror; see the action for why.
     - uses: ./.github/actions/dagger-engine
diff --git a/.github/workflows/settings-verify.yml b/.github/workflows/settings-verify.yml
index be65309f..badf86b9 100644
--- a/.github/workflows/settings-verify.yml
+++ b/.github/workflows/settings-verify.yml
@@ -48,10 +48,11 @@ jobs:
       any: ${{ steps.matrix.outputs.any }}
       cells: ${{ steps.matrix.outputs.cells }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       with:
         # Full history so the PR base is available to diff against.
         fetch-depth: 0
+        persist-credentials: false
     - uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39 # v8.2.0
       with:
         enable-cache: true
@@ -103,7 +104,9 @@ jobs:
     name: settings ${{ matrix.cell.group }}/${{ matrix.cell.release }}/${{ matrix.cell.deployment
       }}
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
     # Installs the CLI and starts an engine that pulls Docker Hub images
     # through a caching mirror; see the action for why.
     - uses: ./.github/actions/dagger-engine
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index cb98e045..391382e3 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -114,3 +114,8 @@ repos:
   rev: v2.14.0
   hooks:
   - id: hadolint-docker
+- repo: https://github.com/zizmorcore/zizmor-pre-commit
+  rev: v1.29.0
+  hooks:
+  - id: zizmor
+    args: [--no-progress, --min-severity=medium, --min-confidence=medium]