diff --git a/.github/workflows/bcload.yml b/.github/workflows/bcload.yml
index c278f0621b2..379976e59bd 100644
--- a/.github/workflows/bcload.yml
+++ b/.github/workflows/bcload.yml
@@ -23,7 +23,10 @@ jobs:
           sudo apt-add-repository "deb http://apt.llvm.org/`lsb_release -c | cut -f2`/ llvm-toolchain-`lsb_release -c | cut -f2`-${{ matrix.llvm }} main" || true
           sudo apt-get install -y cmake gcc g++ llvm-${{ matrix.llvm }}-dev clang-${{ matrix.llvm }} libclang-${{ matrix.llvm }}-dev
           sudo python3 -m pip install --upgrade pip lit
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: mkdir
       run: cd enzyme && rm -rf build && mkdir build
     - name: cmake
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index b4bfa07ded6..1e955dcfefa 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -37,7 +37,10 @@ jobs:
           apt-get  --allow-unauthenticated install -y python3-pip autoconf cmake gcc g++ libtool gfortran libblas-dev llvm-${{ matrix.llvm }}-dev clang-${{ matrix.llvm }} libeigen3-dev libboost-dev libzstd-dev
           python3 -m pip install lit pathlib --break-system-packages
           touch /usr/lib/llvm-${{ matrix.llvm }}/bin/yaml-bench
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: mkdir
       run: rm -rf build && mkdir build
     - name: cmake
diff --git a/.github/workflows/ccpp.yml b/.github/workflows/ccpp.yml
index 9124a4d9829..09481803fc9 100644
--- a/.github/workflows/ccpp.yml
+++ b/.github/workflows/ccpp.yml
@@ -37,7 +37,10 @@ jobs:
           sudo apt-add-repository "deb http://apt.llvm.org/`lsb_release -c | cut -f2`/ llvm-toolchain-`lsb_release -c | cut -f2`-${{ matrix.llvm }} main" || true
           sudo apt-get install -y cmake gcc g++ llvm-${{ matrix.llvm }}-dev libomp-${{ matrix.llvm }}-dev lld-${{ matrix.llvm }} clang-${{ matrix.llvm }} libclang-${{ matrix.llvm }}-dev libeigen3-dev libboost-dev libzstd-dev
           sudo python3 -m pip install --upgrade pip lit
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: mkdir
       run: rm -rf build && mkdir build
     - name: cmake
@@ -51,16 +54,28 @@ jobs:
     - name: make check-enzyme-integration
       working-directory: build
       run: make -j `nproc` check-enzyme-integration
-      
+
     - name: Update Nightly Release
-      uses: ncipollo/release-action@v1
-      if: ${{ !cancelled() && github.ref == 'refs/heads/main' }} 
-      with:
-        tag: nightly
-        name: Nightly Release
-        body: "Latest nightly build of Enzyme."
-        artifacts: "build/Enzyme/LLVMEnzyme-${{ matrix.llvm }}*,build/Enzyme/ClangEnzyme-${{ matrix.llvm }}*,build/Enzyme/LLDEnzyme-${{ matrix.llvm }}*"
-        allowUpdates: true
-        removeArtifacts: false
-        replacesArtifacts: true
-        token: ${{ secrets.GITHUB_TOKEN }}
+      if: ${{ !cancelled() && github.ref == 'refs/heads/main' }}
+      env:
+        GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      run: |
+        if gh release view nightly >/dev/null 2>&1; then
+          gh release edit nightly --title "Nightly Release" --notes "Latest nightly build of Enzyme."
+        else
+          gh release create nightly --title "Nightly Release" --notes "Latest nightly build of Enzyme."
+        fi
+        artifacts=()
+        for pattern in \
+          build/Enzyme/LLVMEnzyme-${{ matrix.llvm }}* \
+          build/Enzyme/ClangEnzyme-${{ matrix.llvm }}* \
+          build/Enzyme/LLDEnzyme-${{ matrix.llvm }}*; do
+          for artifact in $pattern; do
+            [ -e "$artifact" ] && artifacts+=("$artifact")
+          done
+        done
+        if [ ${#artifacts[@]} -gt 0 ]; then
+          gh release upload nightly "${artifacts[@]}" --clobber
+        else
+          echo "No nightly artifacts found for LLVM ${{ matrix.llvm }}."
+        fi
diff --git a/.github/workflows/doxygen.yml b/.github/workflows/doxygen.yml
index 722fbe6b14a..acf6ec95718 100644
--- a/.github/workflows/doxygen.yml
+++ b/.github/workflows/doxygen.yml
@@ -9,19 +9,22 @@ jobs:
   build-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout Enzyme repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
 
-      - uses: mattnotmitt/doxygen-action@v1.12.0
+      - uses: mattnotmitt/doxygen-action@b84fe17600245bb5db3d6c247cc274ea98c15a3b # v1.12.0
         with:
           working-directory: 'enzyme/'
           doxyfile-path: 'doxygen.cfg'
 
       - name: Upload static files as artifact
         id: deployment
-        uses: actions/upload-pages-artifact@v3 # or specific "vX.X.X" version tag for this action
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5
         with:
           path: enzyme/doxygen/html
-          
+
   deploy-docs:
     # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
     permissions:
@@ -38,4 +41,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4 # or specific "vX.X.X" version tag for this action
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 #v5
diff --git a/.github/workflows/enzyme-bazel.yml b/.github/workflows/enzyme-bazel.yml
index d41fdedb7f5..a0cd5653524 100644
--- a/.github/workflows/enzyme-bazel.yml
+++ b/.github/workflows/enzyme-bazel.yml
@@ -1,11 +1,9 @@
 name: Bazel
 
 on:
-  schedule:
-    - cron: 0 0 * * *
   push:
     branches:
-    - main
+      - main
     paths:
       - '.github/workflows/enzyme-bazel.yml'
       - 'enzyme/Enzyme/**'
@@ -16,7 +14,7 @@ on:
       - 'enzyme/WORKSPACE'
   pull_request:
     branches:
-    - main
+      - main
     paths:
       - '.github/workflows/enzyme-bazel.yml'
       - 'enzyme/Enzyme/**'
@@ -28,8 +26,6 @@ on:
   merge_group:
 
 concurrency:
-  # Skip intermediate builds: always.
-  # Cancel intermediate builds: only if it is a pull request build.
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ startsWith(github.ref, 'refs/pull/') }}
 
@@ -40,32 +36,34 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
+        os:
           - linux-x86-n2-32
         build:
           - Release
         llbuild:
           - Release
-    timeout-minutes: 500 
+    timeout-minutes: 500
 
     container:
-      image: ${{ (contains(matrix.os, 'linux') && 'ghcr.io/enzymead/reactant-docker-images@sha256:91e1edb7a7c869d5a70db06e417f22907be0e67ca86641d48adcea221fedc674' ) || '' }}
+      image: ghcr.io/enzymead/reactant-docker-images@sha256:91e1edb7a7c869d5a70db06e417f22907be0e67ca86641d48adcea221fedc674
 
     steps:
       - name: Install Python dependencies
-        run: python -m pip install lit
-      - uses: actions/checkout@v4
-      - uses: actions/checkout@v4
+        run: |
+          python3 -m ensurepip --upgrade || sudo apt-get install -y python3-pip
+          python3 -m pip install --upgrade pip
+          python3 -m pip install lit
+      - name: Checkout Enzyme repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
+          persist-credentials: false
           repository: 'llvm/llvm-project'
           path: 'llvm-project'
-      - uses: bazel-contrib/setup-bazel@0.14.0
+      - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
         name: Set up Bazel
         with:
-          # Avoid downloading Bazel every time.
           bazelisk-cache: true
-          # Store build cache per workflow.
           disk-cache: ${{ github.workflow }}-${{ matrix.os }}-${{ matrix.build }}-${{ matrix.llbuild }}
-          # Share repository cache between workflows.
           repository-cache: true
           bazelisk-version: 1.x
       - name: Build Enzyme
diff --git a/.github/workflows/enzyme-ci.yml b/.github/workflows/enzyme-ci.yml
index 57a2f3494f9..f6a951e1e24 100644
--- a/.github/workflows/enzyme-ci.yml
+++ b/.github/workflows/enzyme-ci.yml
@@ -34,7 +34,10 @@ jobs:
           sudo apt-add-repository "deb http://apt.llvm.org/`lsb_release -c | cut -f2`/ llvm-toolchain-`lsb_release -c | cut -f2`-${{ matrix.llvm }} main" || true
           sudo apt-get install -y cmake gcc g++ llvm-${{ matrix.llvm }}-dev libzstd-dev
           sudo python3 -m pip install --upgrade pip lit
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: mkdir
       run: rm -rf build && mkdir build
     - name: cmake
@@ -71,7 +74,10 @@ jobs:
           brew uninstall cmake
           brew install llvm@${{ matrix.llvm }} make cmake
           sudo python3 -m pip install --upgrade --break-system-packages --user pip lit requests
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: mkdir
       run: rm -rf build && mkdir build
     - name: cmake
@@ -107,7 +113,10 @@ jobs:
           brew uninstall cmake
           brew install llvm@${{ matrix.llvm }} make cmake gcc
           sudo python3 -m pip install --upgrade --break-system-packages --user pip lit
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: mkdir
       run: rm -rf build && mkdir build
     - name: cmake
diff --git a/.github/workflows/enzyme-julia.yml b/.github/workflows/enzyme-julia.yml
index fbacdd7476f..ea48491d582 100644
--- a/.github/workflows/enzyme-julia.yml
+++ b/.github/workflows/enzyme-julia.yml
@@ -9,11 +9,6 @@ on:
     - main
   merge_group:
 
-# needed to allow julia-actions/cache to delete old caches that it has created
-permissions:
-  actions: write
-  contents: read
-
 concurrency:
   # Skip intermediate builds: always.
   # Cancel intermediate builds: only if it is a pull request build.
@@ -24,6 +19,9 @@ jobs:
   build:
     name: Enzyme CI Julia ${{ matrix.version }} ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      actions: write
+      contents: read
     continue-on-error: ${{ matrix.version == 'nightly' }}
     strategy:
       fail-fast: false
@@ -36,11 +34,16 @@ jobs:
           - ubuntu-latest
         arch:
           - 'default'
-    timeout-minutes: 60 
+    timeout-minutes: 60
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/checkout@v5
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
+    - name: Checkout Enzyme.jl repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
+        persist-credentials: false
         repository: 'EnzymeAD/Enzyme.jl'
         path: ./jl
         ref: main
diff --git a/.github/workflows/enzyme-mlir.yml b/.github/workflows/enzyme-mlir.yml
index 2631f5c72ae..eb1ec2520df 100644
--- a/.github/workflows/enzyme-mlir.yml
+++ b/.github/workflows/enzyme-mlir.yml
@@ -38,12 +38,16 @@ jobs:
           apt-get update
           apt-get install -y binutils ninja-build cmake gcc g++ python3 python3-dev
 
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
+        persist-credentials: false
         path: 'Enzyme'
 
-    - uses: actions/checkout@v4
+    - name: Checkout LLVM repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
+        persist-credentials: false
         repository: 'llvm/llvm-project'
         ref: '084f6484d76625b995c07f512a323ab7cdc5351d'
         path: 'llvm-project'
diff --git a/.github/workflows/enzyme-rust.yml b/.github/workflows/enzyme-rust.yml
index 6d794ecac36..37b1e774714 100644
--- a/.github/workflows/enzyme-rust.yml
+++ b/.github/workflows/enzyme-rust.yml
@@ -47,11 +47,14 @@ jobs:
         . ~/.cargo/env
         rustup toolchain install nightly
         rustup default nightly
-    - uses: actions/checkout@v5
-      name: Checkout Enzyme
-    - uses: actions/checkout@v5
-      name: Checkout Rust compiler
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
+        persist-credentials: false
+    - name: Checkout Rust compiler
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
         repository: rust-lang/rust
         ref: ${{ matrix.commit }}
         path: rust
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 4bf18b435a8..5f1a56e3196 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -17,8 +17,11 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-    - uses: actions/checkout@v4
-    - uses: DoozyX/clang-format-lint-action@v0.20
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
+    - uses: DoozyX/clang-format-lint-action@bcb4eb2cb0d707ee4f3e5cc3b456eb075f12cf73 # v0.20
       with:
         source: 'enzyme/Enzyme enzyme/tools/enzyme-tblgen'
         exclude: './CMakeLists.txt enzyme/Enzyme/SCEV'
diff --git a/.github/workflows/fortran.yml b/.github/workflows/fortran.yml
index 6465a77b274..89e8af2a370 100644
--- a/.github/workflows/fortran.yml
+++ b/.github/workflows/fortran.yml
@@ -56,7 +56,10 @@ jobs:
         sudo apt-add-repository "deb http://apt.llvm.org/`lsb_release -c | cut -f2`/ llvm-toolchain-`lsb_release -c | cut -f2`-${{ matrix.llvm }} main"
         sudo apt-get update && sudo apt-get install -y cmake gcc g++ llvm-${{ matrix.llvm }}-dev ninja-build pip clang-${{ matrix.llvm }} flang-${{ matrix.llvm }}
         sudo python3 -m pip install --upgrade pip lit
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: generate build system
       run: |
         rm -rf build && mkdir build && cd build
@@ -101,7 +104,10 @@ jobs:
         sudo apt-get update && sudo apt-get install -y intel-oneapi-compiler-fortran-${{ matrix.versions.ifx }} intel-oneapi-mpi-${{ matrix.mpi }} intel-oneapi-mpi-devel-${{ matrix.mpi }}
         source /opt/intel/oneapi/setvars.sh
         printenv >> $GITHUB_ENV
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: generate build system
       run: |
         rm -rf build && mkdir build && cd build
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 74cd8852fd2..3bb6d6423cb 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -45,13 +45,15 @@ jobs:
           - os: linux-x86-a2-48-a100-4gpu
             package: summit
     steps:
-      - uses: actions/checkout@v7
+      - name: Checkout Enzyme repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
       - name: add llvm
         run: |
           curl -fsSL https://apt.llvm.org/llvm-snapshot.gpg.key | gpg --dearmor -o /usr/share/keyrings/llvm-snapshot.gpg
           apt-add-repository "deb http://apt.llvm.org/`lsb_release -c | cut -f2`/ llvm-toolchain-`lsb_release -c | cut -f2`-${{ matrix.llvm }} main" || true
           apt-get install -y cmake gcc g++ clang-${{ matrix.llvm }} libclang-${{ matrix.llvm }}-dev llvm-${{ matrix.llvm }}-dev libzstd-dev
-      - uses: actions/checkout@v4
       - name: mkdir
         run: rm -rf build && mkdir build
       - name: cmake
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index faabc10f66a..8fb3df6ac50 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -15,9 +15,11 @@ jobs:
   emission-order:
     name: Deterministic IR emission order
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: Check for order-dependent IR emission
       run: |
         python3 enzyme/scripts/check_emission_order.py --github \
@@ -26,9 +28,25 @@ jobs:
   llvm-api:
     name: Direct use of wrapped LLVM APIs
     runs-on: ubuntu-latest
-
     steps:
-    - uses: actions/checkout@v4
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      with:
+        persist-credentials: false
     - name: Check for direct LLVM API calls that Utils.h wraps
       run: |
         python3 enzyme/scripts/check_llvm_api.py --github enzyme/Enzyme
+
+  zizmor:
+    name: GitHub Actions linting
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      security-events: write  # We trust the zizmor action with write permissions
+    steps:
+      - name: Checkout Enzyme repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0
diff --git a/.github/workflows/tagger.yml b/.github/workflows/tagger.yml
index 187f72e48f2..5e8081bba93 100644
--- a/.github/workflows/tagger.yml
+++ b/.github/workflows/tagger.yml
@@ -9,8 +9,11 @@ jobs:
   build:
     name: Enzyme Tag CI
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
     steps:
-    - uses: actions/create-github-app-token@v2
+    - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
       id: generate_token
       with:
         app-id: ${{ secrets.APP_ID }}
@@ -18,15 +21,21 @@ jobs:
         owner: JuliaPackaging
         repositories: |
           Yggdrasil
+        permission-contents: write
+        permission-pull-requests: write
 
-    - uses: actions/checkout@v5
+    - name: Checkout JuliaPackaging repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
-          repository: 'JuliaPackaging/Yggdrasil'
-          path: ygg
+        persist-credentials: false
+        repository: 'JuliaPackaging/Yggdrasil'
+        path: ygg
 
-    - uses: actions/checkout@v5
+    - name: Checkout Enzyme repository
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         path: enz
+        persist-credentials: false
     - name: replace
       run: |
           cd ygg
@@ -39,7 +48,7 @@ jobs:
           git add .
     - name: Create Pull Request
       id: cpr
-      uses: peter-evans/create-pull-request@v7
+      uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
       with:
         path: ygg
         commit-message: "Upgrade enzyme to ${{ github.ref }}"
diff --git a/zizmor.yml b/zizmor.yml
new file mode 100644
index 00000000000..42b00d762c5
--- /dev/null
+++ b/zizmor.yml
@@ -0,0 +1,6 @@
+# Configuration for Zizmor GitHub Actions linter
+rules:
+  template-injection:
+    ignore:
+      # Ignore template injection where it is not a concern
+      - tagger.yml:55