diff --git a/.github/workflows/backup-daily.yml b/.github/workflows/backup-daily.yml
index dafeb31..699b1db 100644
--- a/.github/workflows/backup-daily.yml
+++ b/.github/workflows/backup-daily.yml
@@ -5,9 +5,13 @@ on:
     schedule:
       - cron: 0 6 * * *
 
+# backup.yml only needs the automatic token (referenced as `github.token`, so no
+# secrets have to be passed); AWS access comes from the runner's instance profile.
+permissions:
+  contents: read
+
 jobs:
   s3-backup-daily:
     # Local ref: always runs the version of backup.yml from this repo's own commit,
     # so it is inherently pinned. Other repos must pin to a full commit SHA instead.
     uses: ./.github/workflows/backup.yml
-    secrets: inherit
diff --git a/.github/workflows/backup.yml b/.github/workflows/backup.yml
index 025281a..0ef5cb3 100644
--- a/.github/workflows/backup.yml
+++ b/.github/workflows/backup.yml
@@ -13,14 +13,22 @@ env:
   # `sbt assembly` to fail due to e.g. shapeless having special characters like `λ` in class names.
   # See https://app.shortcut.com/narrativeio/story/19136
   LC_ALL: en_US.UTF-8
-  GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+  # `github.token` rather than `secrets.GITHUB_TOKEN`: the context form resolves in a
+  # called workflow without the caller passing anything, so callers do not need
+  # `secrets: inherit` (see secrets-inherit remediation in backup-daily.yml).
+  GITHUB_TOKEN: ${{ github.token }}
   AWS_REGION: us-east-1
 
 jobs:
   s3-backup:
     runs-on: self-hosted
     steps:
+      # persist-credentials: false is load-bearing here, not just lint compliance: the
+      # s3-backup step below mirrors the whole workspace (including .git/) to S3, so a
+      # persisted token would be written into .git/config in the backup bucket.
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Configure AWS credentials
         id: configure-aws-credentials
         uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 057fb1d..8e223a5 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -5,13 +5,14 @@ on:
     branches:
       - main
 
-permissions:
-  contents: write
-  pull-requests: write
+permissions: {}
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write      # release-please pushes the release branch and creates tags/releases.
+      pull-requests: write # release-please opens and updates the release PR.
     steps:
       - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         with:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..97500e7
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1