diff --git a/.github/workflows/peribolos-apply.yml b/.github/workflows/peribolos-apply.yml
index 0240de8..20b1488 100644
--- a/.github/workflows/peribolos-apply.yml
+++ b/.github/workflows/peribolos-apply.yml
@@ -19,6 +19,9 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
 concurrency:
   group: peribolos-apply
   cancel-in-progress: false
@@ -32,6 +35,8 @@ jobs:
     steps:
       - name: Checkout complytime/.github repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -48,6 +53,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kubernetes-sigs/prow
+          persist-credentials: false
 
       - name: Build peribolos
         if: >-
diff --git a/.github/workflows/peribolos-drift.yml b/.github/workflows/peribolos-drift.yml
index d2413a5..a642097 100644
--- a/.github/workflows/peribolos-drift.yml
+++ b/.github/workflows/peribolos-drift.yml
@@ -14,6 +14,9 @@ on:
     - cron: '30 4 * * 1'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   detect-drift:
     if: github.repository_owner == 'complytime'
@@ -25,6 +28,8 @@ jobs:
     steps:
       - name: Checkout complytime/.github repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
@@ -38,6 +43,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: kubernetes-sigs/prow
+          persist-credentials: false
 
       - name: Build peribolos
         run: |
diff --git a/.github/workflows/peribolos-validate.yml b/.github/workflows/peribolos-validate.yml
index 6ba35fe..893f490 100644
--- a/.github/workflows/peribolos-validate.yml
+++ b/.github/workflows/peribolos-validate.yml
@@ -6,6 +6,9 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   project:
     name: Verify peribolos
@@ -13,6 +16,8 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: './go.mod'
@@ -27,4 +32,4 @@ jobs:
           go test ./...
 
       - name: Install yamllint and check peribolos.yaml
-        run: pip install yamllint && yamllint peribolos.yaml
+        run: pip install yamllint==1.38.0 && yamllint peribolos.yaml
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..f8d75dd
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,11 @@
+# zizmor configuration — https://docs.zizmor.sh/configuration/
+#
+# Peribolos manages the entire complytime GitHub org (membership, teams,
+# repos), so its GitHub App token intentionally has org-wide scope.
+# The github-app audit flags this as dangerous, but scoping the token
+# to individual repositories would break peribolos' core functionality.
+rules:
+  github-app:
+    ignore:
+      - peribolos-apply.yml
+      - peribolos-drift.yml