diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f2a13f9..3c88e4c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -19,6 +19,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "uv"
     directory: "/"
     target-branch: "dev"
@@ -36,6 +38,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     target-branch: "dev"
@@ -53,3 +57,5 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 3880f8b..f151758 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -18,11 +18,13 @@ jobs:
       - name: Check out PR
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           path: head
 
       - name: Check out target branch
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.base.sha }}
           path: base
 
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index e30d6f9..edcd49f 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -1,9 +1,10 @@
 name: CLA
 
+# The CLA bot needs both triggers; cla-reusable.yml never checks out pull request code.
 on:
-  issue_comment:
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, closed, synchronize]
 
 permissions:
diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml
new file mode 100644
index 0000000..b674f80
--- /dev/null
+++ b/.github/workflows/dev-security.yml
@@ -0,0 +1,11 @@
+name: dev-security
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@12139195c6f35d8b4478bb8ec3df94aa275da01e # v1.1.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e008f1f..a04ee42 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,14 +25,14 @@ jobs:
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/rust-tests.yml
+    uses: ./.github/workflows/rust-tests.yml # zizmor: ignore[self-repository]
 
   python:
     needs: check
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/python-tests.yml
+    uses: ./.github/workflows/python-tests.yml # zizmor: ignore[self-repository]
     secrets:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}