diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index 01c6b7d817b7..e2e39b39af38 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -31,6 +31,8 @@ jobs:
         with:
           ruby-version: "3.3"
       - name: Install tools
+        # zizmor: ignore[adhoc-packages]
+        # zizmor: ignore[adhoc-packages]
         run: |
           gem install --no-document toys
       - name: execute
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74c2879d315f..935ee4cef7b1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,11 +63,12 @@ jobs:
       with:
         ruby-version: "${{ matrix.ruby }}"
     - name: Install NodeJS 18.x
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: "18.x || 24.x"
     - name: Install tools
       # zizmor: ignore[template-injection]
+      # zizmor: ignore[adhoc-packages]
       run: "gem install --no-document toys && npm install linkinator"
     - name: Test ${{ matrix.task }}
       # zizmor: ignore[template-injection]
diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml
index ca34396820db..04aa923bf3b3 100644
--- a/.github/workflows/conformance.yaml
+++ b/.github/workflows/conformance.yaml
@@ -37,6 +37,7 @@ jobs:
       with:
         go-version: '>=1.23.0'
     - name: Install tools
+      # zizmor: ignore[adhoc-packages]
       run: "gem install --no-document toys"
     - name: Install dependencies
       run: "cd google-cloud-bigtable/conformance/test_proxy && bundle install"
diff --git a/.github/workflows/delete-library.yml b/.github/workflows/delete-library.yml
index ff92854635c5..d511906ba83a 100644
--- a/.github/workflows/delete-library.yml
+++ b/.github/workflows/delete-library.yml
@@ -29,6 +29,8 @@ jobs:
       with:
         ruby-version: "3.4"
     - name: Install tools
+      # zizmor: ignore[adhoc-packages]
+      # zizmor: ignore[adhoc-packages]
       run: |
         gem install --no-document toys
     - name: Delete-library
diff --git a/.github/workflows/new-library.yml b/.github/workflows/new-library.yml
index 7d4865e5c1e7..2b7dcaa5c61c 100644
--- a/.github/workflows/new-library.yml
+++ b/.github/workflows/new-library.yml
@@ -43,6 +43,8 @@ jobs:
     - name: Install Bazel
       uses: bazel-contrib/setup-bazel@083175551ceeceebc757ebee2127fde78840ca77 # 0.18.0
     - name: Install tools
+      # zizmor: ignore[adhoc-packages]
+      # zizmor: ignore[adhoc-packages]
       run: |
         gem install --no-document toys
     - name: Create library
diff --git a/.github/workflows/owlbot.yml b/.github/workflows/owlbot.yml
index 52aeff4b02d4..72899a337bd4 100644
--- a/.github/workflows/owlbot.yml
+++ b/.github/workflows/owlbot.yml
@@ -31,6 +31,8 @@ jobs:
     - name: Install Bazel
       uses: bazel-contrib/setup-bazel@083175551ceeceebc757ebee2127fde78840ca77 # 0.18.0
     - name: Install tools
+      # zizmor: ignore[adhoc-packages]
+      # zizmor: ignore[adhoc-packages]
       run: |
         gem install --no-document toys
     - name: OwlBot
diff --git a/.github/workflows/release-please-now.yml b/.github/workflows/release-please-now.yml
index 357e2de983c4..2b63c1d73318 100644
--- a/.github/workflows/release-please-now.yml
+++ b/.github/workflows/release-please-now.yml
@@ -29,6 +29,8 @@ jobs:
         with:
           ruby-version: "3.3"
       - name: Install tools
+        # zizmor: ignore[adhoc-packages]
+        # zizmor: ignore[adhoc-packages]
         run: |
           gem install --no-document toys
       - name: execute
diff --git a/.github/workflows/storage-retry-conformance-test-against-emulator.yaml b/.github/workflows/storage-retry-conformance-test-against-emulator.yaml
index 53e52fde9809..08c3e6cdb2e8 100644
--- a/.github/workflows/storage-retry-conformance-test-against-emulator.yaml
+++ b/.github/workflows/storage-retry-conformance-test-against-emulator.yaml
@@ -33,7 +33,9 @@ jobs:
         with:
           ruby-version: '3.3'
       - run: ruby --version
-      - run: gem install toys
+      - name: install toys
+        # zizmor: ignore[adhoc-packages]
+        run: gem install toys
       - run: bundle install
       - run: toys conformance
         env:
diff --git a/.github/workflows/tombstone-library.yml b/.github/workflows/tombstone-library.yml
index 3db67277add8..9fcbb4b7492d 100644
--- a/.github/workflows/tombstone-library.yml
+++ b/.github/workflows/tombstone-library.yml
@@ -29,6 +29,8 @@ jobs:
       with:
         ruby-version: "3.4"
     - name: Install tools
+      # zizmor: ignore[adhoc-packages]
+      # zizmor: ignore[adhoc-packages]
       run: |
         gem install --no-document toys
     - name: Tombstone-library
diff --git a/.github/workflows/update-pr.yml b/.github/workflows/update-pr.yml
index 6671549c383f..e211bb6e2da9 100644
--- a/.github/workflows/update-pr.yml
+++ b/.github/workflows/update-pr.yml
@@ -30,6 +30,8 @@ jobs:
       with:
         ruby-version: "3.3"
     - name: Install tools
+      # zizmor: ignore[adhoc-packages]
+      # zizmor: ignore[adhoc-packages]
       run: |
         gem install --no-document toys
     - name: Update PR