diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6c8d0140..0fd533aa 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           show-progress: false
 
       - name: "Install actionlint"
@@ -25,14 +26,38 @@ jobs:
         run: bash <(curl -fsSL https://raw.githubusercontent.com/rhysd/actionlint/v1.7.12/scripts/download-actionlint.bash) 1.7.12
 
       - name: "Run actionlint"
+        env:
+          ACTIONLINT: "${{ steps.actionlint.outputs.executable }}"
         run: |
           echo "::add-matcher::.github/actionlint-matcher.json"
           trap 'echo "::remove-matcher owner=actionlint::"' EXIT
-          "${{ steps.actionlint.outputs.executable }}" -color
+          "$ACTIONLINT" -color
+
+  lint-zizmor:
+    name: "Audit workflows"
+    runs-on: "ubuntu-24.04"
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout"
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: "Run zizmor"
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          inputs: "."
+          version: "1.29.0"
+          advanced-security: false
+          annotations: true
 
   ci:
     name: "Execute (PHP ${{ matrix.php-version }} with ${{ matrix.dependencies }} deps, composer v${{ matrix.composer-version}}.x, symfony v${{ matrix.symfony-version }})"
     runs-on: "ubuntu-24.04"
+    permissions:
+      contents: read
 
     strategy:
       matrix:
@@ -57,6 +82,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
+          persist-credentials: false
           show-progress: false
 
       - name: "Install PHP"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bcfdb195..a1f20cd6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,8 @@ jobs:
         with:
           client-id: ${{ secrets.LENDABOT_APP_ID }}
           private-key: ${{ secrets.LENDABOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         id: release
diff --git a/.github/workflows/sloth.yml b/.github/workflows/sloth.yml
index 1a114d55..48fb93f4 100644
--- a/.github/workflows/sloth.yml
+++ b/.github/workflows/sloth.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   sloth:
     runs-on: ubuntu-24.04
+    permissions:
+      checks: read
+      contents: read
     steps:
       - name: Sloth
         uses: lendable/sloth@v1
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 00000000..3fc58f20
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "lendable/*": ref-pin