diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index af9d126a..4ec138c2 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1,5 +1,7 @@
 name: CI/CD
 
+permissions: {}
+
 on:
   pull_request:
   workflow_dispatch:
@@ -15,10 +17,12 @@ jobs:
         version: [17, 21, 25]
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
-      
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Install java
-        uses: actions/setup-java@v6.2.0
+        uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0
         with:
           distribution: 'temurin'
           java-version: '${{ matrix.version }}'
@@ -46,13 +50,14 @@ jobs:
     needs: [ci]
     permissions:
       contents: write
-      actions: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # we need to fetch all existing git tags
           fetch-depth: 0
+          # Required to push release tags from scripts/publish.sh.
+          persist-credentials: true
 
       - name: Create git tags and publish to Maven Central
         env:
diff --git a/.github/workflows/labeler.yaml b/.github/workflows/labeler.yaml
index 700e3aac..efc901b7 100644
--- a/.github/workflows/labeler.yaml
+++ b/.github/workflows/labeler.yaml
@@ -23,7 +23,7 @@ jobs:
         run: |
           curl -sSL -o remote-labeler.yml https://raw.githubusercontent.com/stackitcloud/stackit-sdk-go/main/.github/labeler.yml 
       - name: Labeler action
-        uses: actions/labeler@v7.0.0
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           configuration-path: "remote-labeler.yml"
           sync-labels: false
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
new file mode 100644
index 00000000..ab1b5a50
--- /dev/null
+++ b/.github/workflows/zizmor.yaml
@@ -0,0 +1,24 @@
+name: zizmor
+
+permissions: {}
+
+on:
+  pull_request:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+
+jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
diff --git a/scripts/publish.sh b/scripts/publish.sh
index 45dd9182..a515cbe0 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -27,7 +27,7 @@ for file in $(find . -print | sed 's|^./||' | grep -E "(^services/[^/]+/VERSION$
         # Tag doesn't exist. Create a tag and push it.
         echo "Tag '$expected_tag' does not exist."
         git tag -a $expected_tag -m "Release $version"
-        git push origin tag $expected_tag
+        git push origin tag "$expected_tag"
         
         ./gradlew "${gradle_subproject}:publishToMavenCentral"
     fi