diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 452c5c2b1..4c5fbc65a 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Checkout repository without persisting credentials to reduce attack surface
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
       - name: Install mdbook
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 094ca8db6..70c3ba34f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,7 +21,7 @@ jobs:
       RUN_BLACKSMITH: 1
     steps:
       # Checkout repository without persisting credentials to reduce attack surface
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
       - name: Install mdbook
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 863414f2a..9701e3917 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -15,25 +15,21 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
-# Minimal permissions for auditing
-permissions:
-  contents: read
+permissions: {}
 
 jobs:
   zizmor:
     name: Run zizmor security audit
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      # Checkout repository without persisting credentials to reduce attack surface
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
 
-      - name: Install zizmor
-        run: |
-          curl -sSL https://github.com/woodruffw/zizmor/releases/download/v1.24.1/zizmor-x86_64-unknown-linux-gnu.tar.gz | tar -xz
-          chmod +x zizmor
-          sudo mv zizmor /usr/local/bin/
-
-      - name: Run zizmor audit
-        run: zizmor --persona pedantic --min-severity low .github/workflows
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d  # v0.5.6
+        with:
+          persona: pedantic
+          advanced-security: false