diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e300c077..46eeb04d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,11 +22,13 @@ jobs:
     timeout-minutes: 20
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
 
       - name: Set up Ruby and bundle cache
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: .tool-versions
           bundler-cache: true
@@ -35,6 +37,25 @@ jobs:
       - name: Run RuboCop
         run: bundle exec rubocop --format progress
 
+  zizmor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+
+      - name: Run zizmor
+        run: uvx "zizmor@1.29.0" .
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   test:
     runs-on: ubuntu-latest
     timeout-minutes: 45
@@ -79,7 +100,7 @@ jobs:
         ports:
           - 6379:6379
       salesforce_connect:
-        image: 'ghcr.io/raspberrypifoundation/heroku-connect'
+        image: 'ghcr.io/raspberrypifoundation/heroku-connect' # zizmor: ignore[unpinned-images]
         credentials:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
@@ -96,7 +117,9 @@ jobs:
           --health-retries=5
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Install test dependencies
         run: >
@@ -104,10 +127,10 @@ jobs:
           libvips
 
       - name: Set up Firefox
-        uses: browser-actions/setup-firefox@v1
+        uses: browser-actions/setup-firefox@0bc507ddf224827e3b1af68e014d5e42ab93e795 # v1.7.2
 
       - name: Set up Ruby and bundle cache
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: .tool-versions
           bundler-cache: true
@@ -130,7 +153,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage
           path: coverage
diff --git a/.github/workflows/close_stale_issues_and_prs.yml b/.github/workflows/close_stale_issues_and_prs.yml
index 959ed2a6e..f6f51eb30 100644
--- a/.github/workflows/close_stale_issues_and_prs.yml
+++ b/.github/workflows/close_stale_issues_and_prs.yml
@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           operations-per-run: 50
           stale-issue-message: 'This issue is stale because it has been open for 90 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
@@ -22,4 +22,4 @@ jobs:
           days-before-issue-stale: 90
           days-before-pr-stale: 30
           days-before-issue-close: 7
-          days-before-pr-close: 7
\ No newline at end of file
+          days-before-pr-close: 7