diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index c6d6a1b1..2479045f 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -32,8 +32,8 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor
-        # 上游最高 tag 只有 v0.6.4,无 v1(写 v1 会 action 解析失败)
-        uses: zizmorcore/zizmor-action@v0.6.4
+        # 须 pin 具体版本 tag(可用 tag 以上游 releases 页为准)
+        uses: zizmorcore/zizmor-action@v0.7.1
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}