diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 72650e986..2dfca4d58 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -15,4 +15,4 @@ permissions:
 
 jobs:
   validate:
-    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@9c4075a1057c2853a339517fde4063ceccfce861 # main
+    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000..b827b3378
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,8 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        '*': hash-pin
+        gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml: ref-pin
+  secrets-outside-env:
+    disable: true
diff --git a/zizmor.yml b/zizmor.yml
deleted file mode 100644
index 39d1b180c..000000000
--- a/zizmor.yml
+++ /dev/null
@@ -1,3 +0,0 @@
-rules:
-  secrets-outside-env:
-    disable: true