diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d33b192..3691016 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -12,6 +12,8 @@ updates:
     schedule:
       interval: "weekly"
       day: "monday"
+    cooldown:
+      default-days: 7
     open-pull-requests-limit: 5
     # `include: scope` makes Dependabot append the scope itself -> chore(deps):
     # for runtime deps and chore(deps-dev): for dev deps. The scope must NOT be
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1b697fb..c4191bc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,11 +5,8 @@ on:
     branches: [main]
   pull_request:
 
-# Allow the deploy job to publish to GitHub Pages.
 permissions:
   contents: read
-  pages: write
-  id-token: write
 
 jobs:
   build:
@@ -25,6 +22,8 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -61,6 +60,12 @@ jobs:
     concurrency:
       group: pages
       cancel-in-progress: false
+    # Only the deploy job publishes to GitHub Pages; the build, which runs on
+    # pull requests, keeps the read-only token.
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
     environment:
       name: github-pages
       url: ${{ steps.deployment.outputs.page_url }}
diff --git a/.github/workflows/config-docs-in-sync.yml b/.github/workflows/config-docs-in-sync.yml
index 43e66c3..971e414 100644
--- a/.github/workflows/config-docs-in-sync.yml
+++ b/.github/workflows/config-docs-in-sync.yml
@@ -44,12 +44,15 @@ jobs:
     steps:
       - name: Checkout docs
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Checkout config-to-docs
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: owncloud/config-to-docs
           path: .config-to-docs
+          persist-credentials: false
           # Deliberately unpinned. This check asks "do the committed pages match
           # what a maintainer running ctd.sh today would produce", so it has to
           # track the current generator. The composer deps below are pinned
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..8b59595
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,31 @@
+name: Zizmor
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    types:
+      - opened
+      - synchronize
+      - reopened
+  schedule:
+    # Weekly: online audits (known-vulnerable actions, impostor commits) can
+    # start failing without a code change.
+    - cron: '0 4 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+# Grouped per event, so a push to the default branch can never cancel or
+# displace the weekly run. Running pull request runs are cancelled by newer
+# ones; for other events GitHub still replaces a queued run with a newer one.
+concurrency:
+  group: zizmor-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  zizmor:
+    name: Zizmor
+    uses: owncloud/reusable-workflows/.github/workflows/zizmor.yml@main