diff --git a/.github/workflows/_test.yml b/.github/workflows/_test.yml
index 78244df899..624f6956b9 100644
--- a/.github/workflows/_test.yml
+++ b/.github/workflows/_test.yml
@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout TUF
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python (oldest supported version)
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
@@ -49,6 +51,8 @@ jobs:
     steps:
       - name: Checkout TUF
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
diff --git a/.github/workflows/_test_sslib_main.yml b/.github/workflows/_test_sslib_main.yml
index e093fa8002..86b4d946b7 100644
--- a/.github/workflows/_test_sslib_main.yml
+++ b/.github/workflows/_test_sslib_main.yml
@@ -12,6 +12,8 @@ jobs:
     steps:
       - name: Checkout TUF
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index c838b78d29..06e4a70e76 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -20,6 +20,7 @@ jobs:
       - name: Checkout release tag
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           ref: ${{ github.event.workflow_run.head_branch }}
 
       - name: Set up Python
@@ -66,8 +67,8 @@ jobs:
             res = await github.rest.repos.createRelease({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              name: '${{ github.ref_name }}-rc',
-              tag_name: '${{ github.ref }}',
+              name: process.env.REF_NAME + '-rc',
+              tag_name: process.env.REF,
               body: fs.readFileSync('changelog', 'utf8'),
             });
 
@@ -81,6 +82,9 @@ jobs:
               });
             });
             return res.data.id
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          REF: ${{ github.ref }}
 
   release:
     name: Release
@@ -108,6 +112,10 @@ jobs:
             github.rest.repos.updateRelease({
               owner: context.repo.owner,
               repo: context.repo.repo,
-              release_id: '${{ needs.candidate_release.outputs.release_id }}',
-              name: '${{ github.ref_name }}',
+              release_id: process.env.RELEASE_ID,
+              name: process.env.REF_NAME,
             })
+        
+        env:
+          REF_NAME: ${{ github.ref_name }}
+          RELEASE_ID: ${{ needs.candidate_release.outputs.release_id }}
\ No newline at end of file
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index c872b7dae3..0253fbafd4 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -24,11 +24,13 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3 # unpinned since this is not security critical
+      uses: github/codeql-action/init@v3 # zizmor: ignore[unpinned-uses]
       with:
         languages: 'python'
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3 # unpinned since this is not security critical
+      uses: github/codeql-action/analyze@v3 # zizmor: ignore[unpinned-uses]
diff --git a/.github/workflows/conformance.yml b/.github/workflows/conformance.yml
index f8453d66c7..1c3a414dd6 100644
--- a/.github/workflows/conformance.yml
+++ b/.github/workflows/conformance.yml
@@ -15,6 +15,8 @@ jobs:
     steps:
       - name: Checkout conformance client
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Run test suite
         uses: theupdateframework/tuf-conformance@9bfc222a371e30ad5511eb17449f68f855fb9d8f # v2.3.0
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index d7cf583f42..1400d25cf6 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -17,5 +17,7 @@ jobs:
     steps:
       - name: 'Checkout Repository'
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v4 # unpinned since this is not security critical
+        uses: actions/dependency-review-action@v4 # zizmor: ignore[unpinned-uses]
\ No newline at end of file
diff --git a/.github/workflows/maintainer-permissions-reminder.yml b/.github/workflows/maintainer-permissions-reminder.yml
index 05d5bc88b6..54dcbf646e 100644
--- a/.github/workflows/maintainer-permissions-reminder.yml
+++ b/.github/workflows/maintainer-permissions-reminder.yml
@@ -5,13 +5,14 @@ on:
     - cron: '10 10 10 2 *'
   workflow_dispatch:
 
-permissions:
-  issues: write
+permissions: {}
 
 jobs:
   file-reminder-issue:
     name: File issue to review maintainer permissions
     runs-on: ubuntu-latest
+    permissions:
+      issues: write
     steps:
     - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
       with:
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index c1a0edf4de..163b378385 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -23,6 +23,8 @@ jobs:
     steps:
       - name: "Checkout code"
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: "Run analysis"
         uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
@@ -35,6 +37,6 @@ jobs:
           publish_results: true
 
       - name: "Upload to code-scanning dashboard"
-        uses: github/codeql-action/upload-sarif@v3  # unpinned since this is not security critical
+        uses: github/codeql-action/upload-sarif@v3 # zizmor: ignore[unpinned-uses]
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/specification-version-check.yml b/.github/workflows/specification-version-check.yml
index 1d7d0f99ab..9fcd5b4f88 100644
--- a/.github/workflows/specification-version-check.yml
+++ b/.github/workflows/specification-version-check.yml
@@ -15,6 +15,8 @@ jobs:
       version: ${{ steps.get-version.outputs.version }}
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+         persist-credentials: false
       - uses: actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
         with:
           python-version: "3.x"
diff --git a/requirements/lint.txt b/requirements/lint.txt
index 495a9b714d..39d334d4a9 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -8,6 +8,7 @@
 # are pinned to prevent unexpected linting failures when tools update)
 ruff==0.9.6
 mypy==1.15.0
+zizmor==1.3.1
 
 # Required for type stubs
 freezegun==1.5.1
diff --git a/tox.ini b/tox.ini
index 758e3f23c2..21ba256222 100644
--- a/tox.ini
+++ b/tox.ini
@@ -42,6 +42,7 @@ commands =
     ruff format --diff {[testenv:lint]lint_dirs}
 
     mypy {[testenv:lint]lint_dirs}
+    zizmor --persona=pedantic -q .
 
 [testenv:fix]
 deps = {[testenv:lint]deps}