diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index f7df8df..c9042b9 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -12,4 +12,6 @@ on:
 
 jobs:
   validate:
-    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@196aa8e3616c99a3f52918306caeaa01923168f3 # main
+    permissions:
+      contents: read
+    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..4078f01
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': hash-pin
+        'gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml': ref-pin