diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 26106dcafd7..2a198a5550e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,3 +9,5 @@ updates:
       interval: "weekly"
     # Disable @dependabot (except for security updates) because we use @renovate instead
     open-pull-requests-limit: 0
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/api-extractor.yml b/.github/workflows/api-extractor.yml
index 3b1744d63c1..a4489f17ffc 100644
--- a/.github/workflows/api-extractor.yml
+++ b/.github/workflows/api-extractor.yml
@@ -1,6 +1,9 @@
 name: Api Extractor
 on: pull_request
 
+permissions:
+  contents: read
+
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
 jobs:
@@ -10,6 +13,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -17,7 +22,7 @@ jobs:
           node-version: ">=23.6.0"
 
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
 
         # Builds the library and runs the api extractor
       - name: Run Api-Extractor
diff --git a/.github/workflows/arethetypeswrong.yml b/.github/workflows/arethetypeswrong.yml
index 049b84a2c65..75cf1d6e60a 100644
--- a/.github/workflows/arethetypeswrong.yml
+++ b/.github/workflows/arethetypeswrong.yml
@@ -7,6 +7,9 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   arethetypeswrong:
     name: Are the types wrong
@@ -14,12 +17,14 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
 
       - name: Run build
         run: npm run build
diff --git a/.github/workflows/change-prerelease-tag.yml b/.github/workflows/change-prerelease-tag.yml
index dc50a256767..881650c9ba1 100644
--- a/.github/workflows/change-prerelease-tag.yml
+++ b/.github/workflows/change-prerelease-tag.yml
@@ -40,6 +40,8 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          # We want to commit back further down.
+          persist-credentials: true
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
diff --git a/.github/workflows/cleanup-checks.yml b/.github/workflows/cleanup-checks.yml
index dccbfa2aa8c..31fe4d14123 100644
--- a/.github/workflows/cleanup-checks.yml
+++ b/.github/workflows/cleanup-checks.yml
@@ -5,9 +5,14 @@ on:
   pull_request_review:
     types: [submitted, edited]
 
+permissions: {}
+
 jobs:
   add_cleanup_label:
     # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#running-a-workflow-when-a-pull-request-is-approved
+    permissions:
+      contents: read
+      pull-requests: write
     if: |
       github.repository == 'apollographql/apollo-client' &&
       github.event.review.state == 'APPROVED' &&
@@ -17,6 +22,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: add label
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
@@ -25,6 +32,8 @@ jobs:
             await script.add_cleanup_label()
 
   cleanup:
+    permissions:
+      contents: write
     if: |
       github.repository == 'apollographql/apollo-client' &&
       contains(github.event.pull_request.labels.*.name, 'auto-cleanup')
@@ -32,6 +41,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -39,7 +50,7 @@ jobs:
           node-version: ">=23.6.0"
 
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
 
       - name: Run Api-Extractor
         run: npm run extract-api
diff --git a/.github/workflows/compare-build-output.yml b/.github/workflows/compare-build-output.yml
index fe11b391aaa..7e2f4be72cf 100644
--- a/.github/workflows/compare-build-output.yml
+++ b/.github/workflows/compare-build-output.yml
@@ -4,6 +4,9 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+
 jobs:
   comparebuildoutput:
     name: Compare Build Output
@@ -14,15 +17,16 @@ jobs:
         with:
           # Fetch entire git history so we have the parent commit to compare against
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
 
       - name: Run comparison script
         id: attw
-        run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${{ github.base_ref }}) | tee $GITHUB_STEP_SUMMARY
+        run: ./config/compare-build-output-to.sh $(git merge-base HEAD origin/${GITHUB_BASE_REF}) | tee $GITHUB_STEP_SUMMARY
         env:
           RUNNER_TEMP: ${{ runner.temp }}
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index 869ba3eaa4a..4837e3952d2 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -27,6 +27,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
diff --git a/.github/workflows/devtools-errorcodes.yml b/.github/workflows/devtools-errorcodes.yml
deleted file mode 100644
index 1cd4d54bde6..00000000000
--- a/.github/workflows/devtools-errorcodes.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Devtools - Trigger Error Code PR after npm Release
-on:
-  workflow_dispatch: # for testing
-  workflow_run:
-    workflows: ["Prerelease", "Release"]
-    types:
-      - completed
-jobs:
-  dispatch:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
-        id: github-actions-bot-app-token
-        with:
-          app-id: 819772
-          private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }}
-          repositories: apollo-client-devtools
-      - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1
-        with:
-          workflow: update-errorcodes.yml
-          repo: apollographql/apollo-client-devtools
-          token: ${{ steps.github-actions-bot-app-token.outputs.token }}
diff --git a/.github/workflows/docmodel.yml b/.github/workflows/docmodel.yml
index 7c2b753a6e1..273d3122363 100644
--- a/.github/workflows/docmodel.yml
+++ b/.github/workflows/docmodel.yml
@@ -3,6 +3,9 @@ name: Generate Documentation Model
 on:
   push:
 
+permissions:
+  contents: read
+
 jobs:
   docmodel:
     name: Generate Documentation Model
@@ -10,6 +13,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -17,7 +22,7 @@ jobs:
           node-version: ">=23.6.0"
 
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
 
       - name: Generate documentation model
         run: npm run docmodel
diff --git a/.github/workflows/exit-prerelease.yml b/.github/workflows/exit-prerelease.yml
index 09cbe3cf209..6b6c0bf1401 100644
--- a/.github/workflows/exit-prerelease.yml
+++ b/.github/workflows/exit-prerelease.yml
@@ -35,6 +35,8 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          # We want to commit back further down.
+          persist-credentials: true
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
diff --git a/.github/workflows/knip.yml b/.github/workflows/knip.yml
index a4918d0a4fb..9ff6e3753fc 100644
--- a/.github/workflows/knip.yml
+++ b/.github/workflows/knip.yml
@@ -2,14 +2,19 @@ name: Look for dead code and unused dependencies
 
 on: push
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     runs-on: ubuntu-latest
     name: Ubuntu/Node v20
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
       - name: Run knip
         run: npm run knip
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index c0a3b874d14..5f7ddfcf7d1 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -22,7 +22,7 @@ jobs:
       pull-requests: write
       id-token: write
     steps:
-      - uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: github-actions-bot-app-token
         with:
           app-id: 819772
@@ -37,6 +37,7 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check for pre.json file existence
         id: check_files
diff --git a/.github/workflows/publish-pr-releases.yml b/.github/workflows/publish-pr-releases.yml
index 4dee47974c2..cd90608f5ca 100644
--- a/.github/workflows/publish-pr-releases.yml
+++ b/.github/workflows/publish-pr-releases.yml
@@ -7,19 +7,28 @@ on:
       - "**"
     tags:
       - "!**"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   prerelease:
     name: Pull Request Prerelease
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
+          package-manager-cache: false
 
       - name: Check if any files in codegen/ changed
         id: changed-files-codegen
@@ -34,7 +43,7 @@ jobs:
           file-filter: "scripts/codemods/ac3-to-ac4/**"
 
       - name: Install dependencies with cache
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
 
       - name: Build AC
         run: npm run build
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b2dbe0a6604..7f2fee1190d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,6 +9,8 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions: {}
+
 jobs:
   release:
     name: Changesets Release
@@ -32,6 +34,7 @@ jobs:
           # Fetch entire git history so  Changesets can generate changelogs
           # with the correct commits
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Check for pre.json file existence
         id: check_files
@@ -140,6 +143,8 @@ jobs:
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
@@ -156,3 +161,22 @@ jobs:
           if NEXT=$(npm show ${{ matrix.package.name }}@next version) node -e 'process.exit(require("semver").gt("${{ matrix.package.version }}",process.env.NEXT)?0:1)'; then
             npm dist-tag add ${{ matrix.package.name }}@${{ matrix.package.version }} next;
           fi
+
+  devtools-errorcodes:
+    name: Trigger Devtools Error Code Update
+    needs: release
+    if: needs.release.result == 'success' && needs.release.outputs.published == 'true'
+    runs-on: ubuntu-latest
+    permissions: {}
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        id: github-actions-bot-app-token
+        with:
+          app-id: 819772
+          private-key: ${{ secrets.APOLLO_GITHUB_ACTIONS_BOT_PRIVATE_KEY }}
+          repositories: apollo-client-devtools
+      - uses: benc-uk/workflow-dispatch@7a027648b88c2413826b6ddd6c76114894dc5ec4 # v1
+        with:
+          workflow: update-errorcodes.yml
+          repo: apollographql/apollo-client-devtools
+          token: ${{ steps.github-actions-bot-app-token.outputs.token }}
diff --git a/.github/workflows/scheduled-test-canary.yml b/.github/workflows/scheduled-test-canary.yml
index 846c0f2278c..f092b9f4ccd 100644
--- a/.github/workflows/scheduled-test-canary.yml
+++ b/.github/workflows/scheduled-test-canary.yml
@@ -14,6 +14,9 @@ on:
         description: "React and React-DOM versions"
         required: true
         default: '["canary", "experimental"]'
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -26,12 +29,15 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           ref: ${{ matrix.branch }}
+          persist-credentials: false
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
-      - uses: bahmutov/npm-install@v1
+      - uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
       - run: |
-          npm install react@${{ matrix.tag }} react-dom@${{ matrix.tag }}
+          npm install react@${MATRIX_TAG} react-dom@${MATRIX_TAG}
+        env:
+          MATRIX_TAG: ${{ matrix.tag }}
       # tests can be flaky, this runs only once a day and we want to minimize false negatives - retry up to three times
       - run: |
           node -e 'console.log("\n\nReact %s, React-DOM %s\n\n", require("react").version, require("react-dom").version)'
diff --git a/.github/workflows/size-limit.yml b/.github/workflows/size-limit.yml
index ffa24aa28bf..fd1bb8b6b33 100644
--- a/.github/workflows/size-limit.yml
+++ b/.github/workflows/size-limit.yml
@@ -8,15 +8,20 @@ on:
 jobs:
   size:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
     steps:
       - name: Checkout repo
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          persist-credentials: false
       - name: Setup Node.js
         uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
         with:
           node-version: ">=23.6.0"
       - name: Install dependencies (with cache)
-        uses: bahmutov/npm-install@v1
+        uses: bahmutov/npm-install@20216767ca67f0f7b4d095dc5859c5700a6581cb # v1
       - name: Run size-limit
         uses: andresz1/size-limit-action@e7493a72a44b113341c0cf6186ab49c17c4b65c1 # v1
         with:
diff --git a/.github/workflows/sync-skill.yml b/.github/workflows/sync-skill.yml
index 47ad2fa5675..e50e309b0a8 100644
--- a/.github/workflows/sync-skill.yml
+++ b/.github/workflows/sync-skill.yml
@@ -5,6 +5,8 @@ on:
     paths:
       - "docs/agent-skills/apollo-client/**"
   workflow_dispatch: # for testing
+permissions: {}
+
 jobs:
   dispatch:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000000..4209691ed2c
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read # Only needed for private repos. Needed to clone the repo.
+      actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3