diff --git a/.github/workflows/megalinter.yaml b/.github/workflows/megalinter.yaml
index 1a6dba1..7cb2804 100644
--- a/.github/workflows/megalinter.yaml
+++ b/.github/workflows/megalinter.yaml
@@ -25,6 +25,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.repo.full_name == github.repository && github.head_ref || '' }}
+          persist-credentials: false
       - name: MegaLinter
         uses: oxsecurity/megalinter/flavors/documentation@v9
         env:
diff --git a/.github/workflows/semantic-release.yaml b/.github/workflows/semantic-release.yaml
index fc4f654..43872e6 100644
--- a/.github/workflows/semantic-release.yaml
+++ b/.github/workflows/semantic-release.yaml
@@ -38,11 +38,16 @@ jobs:
         with:
           app-id: ${{ inputs.GH_SEM_REL_APP_ID }}
           private-key: ${{ secrets.GH_SEM_REL_APP_PEM_FILE }}
+          repositories: ${{ github.repository }}
+          permission-contents: write
+          permission-issues: write
+          permission-pull-requests: write
       - name: Checkout repository
         uses: actions/checkout@v7
         with:
           token: ${{ steps.gh-app-token.outputs.token || secrets.GITHUB_TOKEN }}
           fetch-depth: 0
+          persist-credentials: true
       - name: Set up Node.js
         uses: actions/setup-node@v7
         with:
@@ -50,15 +55,9 @@ jobs:
       - name: Install Semantic Release
         env:
           SEMANTIC_RELEASE_PLUGINS: ${{ inputs.semantic_release_plugins }}
-        run: >
-          npm install
-          --ignore-scripts
-          semantic-release
-          conventional-changelog-conventionalcommits
-          @semantic-release/changelog
-          @semantic-release/git
-          semantic-release-major-tag
-          $SEMANTIC_RELEASE_PLUGINS
+        run: |
+          mapfile -t plugins <<< "$SEMANTIC_RELEASE_PLUGINS"
+          npm install --ignore-scripts semantic-release conventional-changelog-conventionalcommits @semantic-release/changelog @semantic-release/git semantic-release-major-tag "${plugins[@]}"
       - name: Verify Semantic Release
         run: npm audit signatures
       - name: Run Semantic Release
diff --git a/.mega-linter.yml b/.mega-linter.yml
index 1d9f34c..1472327 100644
--- a/.mega-linter.yml
+++ b/.mega-linter.yml
@@ -2,6 +2,8 @@
 ENABLE:
   - ACTION
   - MARKDOWN
+ACTION_ZIZMOR_UNSECURED_ENV_VARIABLES:
+  - GITHUB_TOKEN
 # CHANGELOG.md is generated by semantic-release
 MARKDOWN_FILTER_REGEX_EXCLUDE: "(CHANGELOG\\.md)"
 SHOW_ELAPSED_TIME: true
diff --git a/zizmor.yaml b/zizmor.yaml
new file mode 100644
index 0000000..bbb0366
--- /dev/null
+++ b/zizmor.yaml
@@ -0,0 +1,6 @@
+---
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": ref-pin