diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 30ba1a0..b00178f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -3,4 +3,10 @@ on:
   pull_request:
 jobs:
   zizmor:
-    uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@8fa210559ab2cc62e7b12d3bb9cba19dbc862c11
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      pull-requests: write
+      security-events: write
+    uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@5a413efebe3688c4761412b1c211af0e03c0e892
diff --git a/testdata/.github/workflows/empty.yml b/testdata/.github/workflows/empty.yml
new file mode 100644
index 0000000..f9fe1f1
--- /dev/null
+++ b/testdata/.github/workflows/empty.yml
@@ -0,0 +1,13 @@
+on:
+  push:
+  pull_request:
+
+jobs:
+  zizmor:
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+      pull-requests: write
+      security-events: write
+    uses: grafana/shared-workflows/.github/workflows/reusable-zizmor.yml@8bc832fdda20909e19808ad2e59017d6e68f4c33
diff --git a/testdata/.github/workflows/testworkflow.yml b/testdata/.github/workflows/testworkflow.yml
deleted file mode 100644
index e69de29..0000000