diff --git a/.github/workflows/check-pr-template.yml b/.github/workflows/check-pr-template.yml
index 0382c56..2b58897 100644
--- a/.github/workflows/check-pr-template.yml
+++ b/.github/workflows/check-pr-template.yml
@@ -11,4 +11,4 @@ jobs:
     name: Check PR template
     permissions:
       contents: read
-    uses: beeware/.github/.github/workflows/pr-checklist.yml@84508d17a1d29ee3b82ce2e467dcd38c4a0c6a5a  # main
+    uses: beeware/.github/.github/workflows/pr-checklist.yml@main
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b643487..274d50f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ permissions:
 jobs:
   pre-commit:
     name: Pre-commit checks
-    uses: beeware/.github/.github/workflows/pre-commit-run.yml@84508d17a1d29ee3b82ce2e467dcd38c4a0c6a5a  # main
+    uses: beeware/.github/.github/workflows/pre-commit-run.yml@main
     with:
       pre-commit-source: "--group pre-commit"
 
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..b834aff
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      # Allow BeeWare-provided actions to be unpinned. If an attacker is in a
+      # position to exploit those action, they're probably able to exploit
+      # repositories directly; and it's significantly easier for our internal
+      # actions to automatically be the most recent versions.
+      policies:
+        beeware/*: ref-pin