diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ccff2e43..ebbd8bb7 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -2,22 +2,27 @@ name: "Deploy site"
 
 on:
   push:
-    branches:
-    - 'master'
+    branches: ['master']
+
+permissions: {}
 
 jobs:
-  example-1:
+  deploy:
     name: Deploy lektor website
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout branch
-        uses: actions/checkout@v2
+        uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
+        with:
+          persist-credentials: false
       - name: Setup node
-        uses: actions/setup-node@v1
+        uses: actions/setup-node@f1f314fca9dfce2769ece7d933488f076716723e # v1.4.6
         with:
           node-version: '10'
       - name: Setup Python
-        uses: actions/setup-python@v1
+        uses: actions/setup-python@0f07f7f756721ebd886c2462646a35f78a8bc4de # v1.2.4
         with:
           python-version: '3.12'
           architecture: 'x64'
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..6d0b1ea7
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,33 @@
+# https://docs.zizmor.sh/integrations/#github-actions
+name: Zizmor (GitHub Actions Security)
+
+on:
+  push:
+    paths:
+      - '.github/workflows/**'
+  pull_request:
+    paths:
+      - '.github/workflows/**'
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read # Required for private repos
+      actions: read # Required for private repos
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        with:
+          advanced-security: false