diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..066427b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ai-breaking-change.yml b/.github/workflows/ai-breaking-change.yml
index a20b7a2..f795671 100644
--- a/.github/workflows/ai-breaking-change.yml
+++ b/.github/workflows/ai-breaking-change.yml
@@ -34,7 +34,9 @@ jobs:
       breaking: ${{ steps.parse.outputs.breaking }}
       items: ${{ steps.parse.outputs.items }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Filter diff
         id: filter
diff --git a/.github/workflows/ai-classify-pr.yml b/.github/workflows/ai-classify-pr.yml
index 977d3ee..8739d01 100644
--- a/.github/workflows/ai-classify-pr.yml
+++ b/.github/workflows/ai-classify-pr.yml
@@ -27,7 +27,9 @@ jobs:
     outputs:
       label: ${{ steps.validate.outputs.label }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Build prompt
         env:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..c4bb99e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+jobs:
+  lint-actions:
+    name: GitHub Actions audit
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Run actionlint
+        uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+        with:
+          advanced-security: false
diff --git a/.github/workflows/sensitive-change-gate.yml b/.github/workflows/sensitive-change-gate.yml
index a57c859..63aef57 100644
--- a/.github/workflows/sensitive-change-gate.yml
+++ b/.github/workflows/sensitive-change-gate.yml
@@ -91,6 +91,7 @@ jobs:
             FOOTER='> **Shadow mode** — this check is informational only. When activated, changes to these paths will require approval from a maintainer.'
           else
             HEADER="Sensitive Change Detection"
+            # shellcheck disable=SC2016
             FOOTER='> Changes to control-plane files require approval from a maintainer. Add the `sensitive-change-approved` label to proceed.'
           fi