diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f6f9e596..a95118e4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,5 +16,7 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: build
diff --git a/.github/workflows/crl.yml b/.github/workflows/crl.yml
index 9fc0c0dc..9725785d 100644
--- a/.github/workflows/crl.yml
+++ b/.github/workflows/crl.yml
@@ -7,7 +7,7 @@ on:
   schedule:
     - cron: "0 0 * * *" # daily; keeps nextUpdate fresh (spec §3.1)
   workflow_dispatch:
-  workflow_run:
+  workflow_run: # zizmor: ignore[dangerous-triggers] runs main's own crlgen and reads nothing from the triggering run
     workflows: [revocation, privileged-revocation]
     types: [completed]
 
@@ -29,6 +29,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
@@ -41,6 +43,7 @@ jobs:
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
       - name: Generate and publish CRL
         env:
           GITHUB_TOKEN: ${{ steps.apptoken.outputs.token }}
diff --git a/.github/workflows/issuer.yml b/.github/workflows/issuer.yml
index 02cae42f..d870814b 100644
--- a/.github/workflows/issuer.yml
+++ b/.github/workflows/issuer.yml
@@ -28,6 +28,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
@@ -47,7 +49,9 @@ jobs:
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
-          owner: ${{ github.repository_owner }}
+          owner: ${{ github.repository_owner }} # zizmor: ignore[github-app] target app repos are only known at runtime (issue #35)
+          permission-contents: write
+          permission-issues: write
       - name: Run issuer
         env:
           GITHUB_TOKEN: ${{ steps.apptoken.outputs.token }}
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 1dd6bdde..540cc382 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -41,6 +41,8 @@ jobs:
       url: ${{ steps.deploy.outputs.page_url }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0
       # Stage ONLY the CRL files (design §13). This explicit copy is the single
       # guarantee that the Pages site contains nothing but the CRL(s) — no repo
diff --git a/.github/workflows/privileged-revocation.yml b/.github/workflows/privileged-revocation.yml
index 941eda00..1a094034 100644
--- a/.github/workflows/privileged-revocation.yml
+++ b/.github/workflows/privileged-revocation.yml
@@ -40,6 +40,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
@@ -50,6 +52,7 @@ jobs:
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
       - name: Run privileged revocation
         env:
           GITHUB_TOKEN: ${{ steps.apptoken.outputs.token }}
diff --git a/.github/workflows/revocation.yml b/.github/workflows/revocation.yml
index d96acf31..9b280498 100644
--- a/.github/workflows/revocation.yml
+++ b/.github/workflows/revocation.yml
@@ -29,6 +29,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
@@ -39,6 +41,8 @@ jobs:
         with:
           app-id: ${{ secrets.BOT_APP_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-issues: write
       - name: Run revoker
         env:
           GITHUB_TOKEN: ${{ steps.apptoken.outputs.token }}
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 4a9fbd55..1327a8cb 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -14,6 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..f9918c4e
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,30 @@
+name: Zizmor
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  schedule:
+    # Weekly: online audits (known-vulnerable actions, impostor commits) can
+    # start failing without a code change.
+    - cron: '0 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Grouped per event, so a push to the default branch can never cancel or
+# displace the weekly run; only pull request runs cancel superseded ones.
+concurrency:
+  group: zizmor-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  zizmor:
+    name: Zizmor
+    uses: owncloud/reusable-workflows/.github/workflows/zizmor.yml@main