diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml
index 7d9a67c..283a19a 100644
--- a/.github/workflows/dev-security.yml
+++ b/.github/workflows/dev-security.yml
@@ -35,3 +35,8 @@ jobs:
       - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           advanced-security: false
+          # Pinned, so the gate's verdict changes only when we change it. The action defaults to the
+          # newest zizmor, which can add audits overnight.
+          version: "1.15.2"
+          # Block on real problems; low-severity findings are style and would train people to ignore the gate.
+          min-severity: medium
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 5cd6b13..1a13821 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,7 +14,10 @@ jobs:
     permissions:
       contents: read
       actions: read
-    uses: blacklanternsecurity/CLA/.github/workflows/release-check.yml@6fc2cf5fe9b8458452c494e8f3285d4aa250e076 # fix/release-on-stable (rehearsal)
+      pull-requests: read
+    uses: blacklanternsecurity/release-workflows/.github/workflows/release-check.yml@c53c202eedeb26a86088936363e6cb06ce99ac15 # v1.0.0
+    secrets:
+      BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }}
 
   tests:
     needs: check
@@ -63,9 +66,11 @@ jobs:
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: blacklanternsecurity/CLA/.github/workflows/publish.yml@6fc2cf5fe9b8458452c494e8f3285d4aa250e076 # fix/release-on-stable (rehearsal)
+    uses: blacklanternsecurity/release-workflows/.github/workflows/publish.yml@c53c202eedeb26a86088936363e6cb06ce99ac15 # v1.0.0
     with:
       version: ${{ needs.check.outputs.version }}
       tag: ${{ needs.check.outputs.tag }}
       artifacts: dist
       assets: dist/*
+    secrets:
+      BLS_RELEASE_PRIVATE_KEY: ${{ secrets.BLS_RELEASE_PRIVATE_KEY }}