diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index f5acf65..a8c4f72 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -17,4 +17,4 @@ permissions:
 
 jobs:
   validate:
-    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@fe1d5e91f4c46fb4bc7a131afe3bb1239c39a3fb # main
+    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..c0ab152
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,7 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': hash-pin
+        # Permit a mutable ref only for the trusted shared validator.
+        gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml: ref-pin