diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 80b0b3e..198ae75 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: "ci"
     groups:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9a78c00..5bb4823 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,6 +13,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -20,12 +22,15 @@ jobs:
       fail-fast: false
       matrix:
         python-version: [ "3.10", "3.11", "3.12", "3.13", "3.14", "3.15" ]
+    permissions:
+      contents: read
     env:
-      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       COVERAGE_PYTHON_VERSION: "3.14"
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Set up Python
         id: setup-python
@@ -55,6 +60,8 @@ jobs:
 
       - name: Report coverage
         if: matrix.python-version == env.COVERAGE_PYTHON_VERSION
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           make coveralls
 
@@ -65,6 +72,7 @@ jobs:
       name: pypi
       url: https://pypi.org/p/rolo
     permissions:
+      contents: read
       id-token: write
     if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags/v')
     steps:
@@ -72,6 +80,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
new file mode 100644
index 0000000..c9d3d37
--- /dev/null
+++ b/.github/workflows/lint-workflows.yml
@@ -0,0 +1,37 @@
+name: Lint GitHub Actions workflows
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.github/**'
+  pull_request:
+    branches:
+      - main
+    paths:
+      - '.github/**'
+
+permissions: {}
+
+jobs:
+  lint-workflows:
+    name: Run linters
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run actionlint
+        uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          # don't upload the results to GitHub Advanced Security, fail the job instead
+          advanced-security: false