diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index abe6a2c3a..4f3290f58 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -49,7 +49,7 @@ jobs:
 
     # Install a more recent Go that understands modern go.mod content.
     - name: Install Go
-      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # zizmor: ignore[cache-poisoning] v6.3.0
       with:
         go-version-file: go.mod
 
diff --git a/.github/workflows/installer.yml b/.github/workflows/installer.yml
index 9b49c4c07..757c1fd9e 100644
--- a/.github/workflows/installer.yml
+++ b/.github/workflows/installer.yml
@@ -69,7 +69,7 @@ jobs:
           - { image: "fedora:latest", deps: "curl", version: "1.80.0" }
     runs-on: ubuntu-latest
     container:
-      image: ${{ matrix.image }}
+      image: ${{ matrix.image }} # zizmor: ignore[unpinned-images]
       options: --user root
     steps:
     - name: install dependencies (pacman)
diff --git a/.github/workflows/request-dataplane-review.yml b/.github/workflows/request-dataplane-review.yml
index 44af549bb..1367a6518 100644
--- a/.github/workflows/request-dataplane-review.yml
+++ b/.github/workflows/request-dataplane-review.yml
@@ -22,6 +22,8 @@ jobs:
           # Get token for app: https://github.com/apps/change-visibility-bot
           app-id: ${{ secrets.VISIBILITY_BOT_APP_ID }}
           private-key: ${{ secrets.VISIBILITY_BOT_APP_PRIVATE_KEY }}
+          # Limit the token to only requesting reviewers on pull requests.
+          permission-pull-requests: write
       - name: Add reviewers
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/request-k8s-review.yml b/.github/workflows/request-k8s-review.yml
index eba1c45ef..da335fb88 100644
--- a/.github/workflows/request-k8s-review.yml
+++ b/.github/workflows/request-k8s-review.yml
@@ -29,6 +29,8 @@ jobs:
           # Get token for app: https://github.com/apps/change-visibility-bot
           app-id: ${{ secrets.VISIBILITY_BOT_APP_ID }}
           private-key: ${{ secrets.VISIBILITY_BOT_APP_PRIVATE_KEY }}
+          # Limit the token to only requesting reviewers on pull requests.
+          permission-pull-requests: write
       - name: Add reviewers
         env:
           GH_TOKEN: ${{ steps.generate-token.outputs.token }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 325461060..4a41c16ef 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -70,7 +70,7 @@ jobs:
         run: go mod download
       - name: Cache Go modules
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # zizmor: ignore[cache-poisoning] v5.0.4
         with:
           path: gomodcache # relative to workspace; see env note at top of file
           key: ${{ steps.hash.outputs.key }}
@@ -345,7 +345,7 @@ jobs:
     needs: gomod-cache
     runs-on: ubuntu-24.04
     container:
-      image: golang:latest
+      image: golang:latest # zizmor: ignore[unpinned-images]
       options: --privileged
     steps:
     - name: checkout
diff --git a/.github/workflows/update-flake.yml b/.github/workflows/update-flake.yml
index ce77cf651..f594fd6df 100644
--- a/.github/workflows/update-flake.yml
+++ b/.github/workflows/update-flake.yml
@@ -33,6 +33,9 @@ jobs:
           # Get token for app: https://github.com/apps/tailscale-code-updater
           app-id: ${{ secrets.CODE_UPDATER_APP_ID }}
           private-key: ${{ secrets.CODE_UPDATER_APP_PRIVATE_KEY }}
+          # Limit the token to only pushing a branch and opening a pull request.
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Send pull request
         uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 #v8.1.0
diff --git a/.github/workflows/update-webclient-prebuilt.yml b/.github/workflows/update-webclient-prebuilt.yml
index 5bb0573a1..fd8876ecf 100644
--- a/.github/workflows/update-webclient-prebuilt.yml
+++ b/.github/workflows/update-webclient-prebuilt.yml
@@ -29,6 +29,9 @@ jobs:
           # Get token for app: https://github.com/apps/tailscale-code-updater
           app-id: ${{ secrets.CODE_UPDATER_APP_ID }}
           private-key: ${{ secrets.CODE_UPDATER_APP_PRIVATE_KEY }}
+          # Limit the token to only pushing a branch and opening a pull request.
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Send pull request
         id: pull-request
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 000000000..181d02bc2
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,32 @@
+name: security lint GitHub Actions  with zizmor
+
+on:
+  push:
+    branches: ["main"]
+    paths:
+      - ".github/workflows/**"
+  pull_request:
+    branches: ["**"]
+    paths:
+      - ".github/workflows/**"
+
+permissions: {}
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read 
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          min-severity: high
+          advanced-security: false
+          annotations: true