diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
index d7745cb8f..3d0ec875b 100644
--- a/.github/workflows/bump-version.yml
+++ b/.github/workflows/bump-version.yml
@@ -22,10 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Cache dependencies
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: "yarn"
diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 35a6a1ba7..24178e73c 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -15,6 +15,25 @@ permissions:
   packages: read
 
 jobs:
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@d4b2f3b6ecc6e67c4457f6d3e41ec42d3d0fcb86 # v5.4.2
+
+      - name: Run zizmor
+        run: uvx "zizmor@1.29.0" --format=github .
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   lint:
     runs-on: ubuntu-latest
     env:
@@ -22,10 +41,12 @@ jobs:
       NPM_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Check for SCSS changes
-        uses: dorny/paths-filter@v3
+        uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
         id: changes
         with:
           filters: |
@@ -36,7 +57,7 @@ jobs:
               - 'package.json'
 
       - name: Cache dependencies
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: "yarn"
@@ -61,10 +82,12 @@ jobs:
       NPM_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Cache dependencies
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: "yarn"
@@ -101,10 +124,12 @@ jobs:
       REACT_APP_SCRATCH_FRAME_URL: "http://localhost:3014"
     steps:
       - name: Checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Cache dependencies
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: "yarn"
@@ -119,7 +144,7 @@ jobs:
         run: yarn build:all
 
       - name: Cypress run
-        uses: cypress-io/github-action@v7
+        uses: cypress-io/github-action@fa4a118725a8f001170d49631ea89e5d66fee626 # v7.4.1
         with:
           install: false
           start: |
@@ -130,7 +155,7 @@ jobs:
           browser: chrome
 
       - name: Archive cypress artifacts
-        uses: actions/upload-artifact@v4.6.0
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         if: failure()
         with:
           name: cypress-artifacts
diff --git a/.github/workflows/close_stale_issues_and_prs.yml b/.github/workflows/close_stale_issues_and_prs.yml
index 968ff1c8d..e22df91fa 100644
--- a/.github/workflows/close_stale_issues_and_prs.yml
+++ b/.github/workflows/close_stale_issues_and_prs.yml
@@ -13,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           stale-issue-message: 'This issue is stale because it has been open for 90 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
           stale-pr-message: 'This PR is stale because it has been open for 30 days with no activity. Remove stale label or comment or this will be closed in 7 days.'
@@ -22,4 +22,4 @@ jobs:
           days-before-issue-stale: 90
           days-before-pr-stale: 30
           days-before-issue-close: 7
-          days-before-pr-close: 7
\ No newline at end of file
+          days-before-pr-close: 7
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index d949efca1..15818716f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -92,19 +92,25 @@ jobs:
       - id: setup-environment
         run: |
           safe_ref_name="${GITHUB_REF_NAME//[![:alnum:].]/_}"
-          deploy_dir=${{inputs.prefix}}/$safe_ref_name
-          public_url=${{inputs.base_url}}/$deploy_dir
-          assets_url=${{inputs.assets_url}}/$deploy_dir
-          html_renderer_url=${{inputs.html_renderer_url}}/$deploy_dir
+          deploy_dir=${INPUTS_PREFIX}/$safe_ref_name
+          public_url=${INPUTS_BASE_URL}/$deploy_dir
+          assets_url=${INPUTS_ASSETS_URL}/$deploy_dir
+          html_renderer_url=${INPUTS_HTML_RENDERER_URL}/$deploy_dir
           echo "deploy_dir=$deploy_dir" >> $GITHUB_OUTPUT
           echo "public_url=$public_url" >> $GITHUB_OUTPUT
           echo "assets_url=$assets_url" >> $GITHUB_OUTPUT
           echo "html_renderer_url=$html_renderer_url" >> $GITHUB_OUTPUT
-          if [ "${{inputs.react_app_base_url}}" = "unspecified" ] ; then
+          if [ "${INPUTS_REACT_APP_BASE_URL}" = "unspecified" ] ; then
             echo "react_app_base_url=$deploy_dir" >> $GITHUB_OUTPUT
           else
-            echo "react_app_base_url=${{inputs.react_app_base_url}}" >> $GITHUB_OUTPUT
+            echo "react_app_base_url=${INPUTS_REACT_APP_BASE_URL}" >> $GITHUB_OUTPUT
           fi
+        env:
+          INPUTS_PREFIX: ${{inputs.prefix}}
+          INPUTS_BASE_URL: ${{inputs.base_url}}
+          INPUTS_ASSETS_URL: ${{inputs.assets_url}}
+          INPUTS_HTML_RENDERER_URL: ${{inputs.html_renderer_url}}
+          INPUTS_REACT_APP_BASE_URL: ${{inputs.react_app_base_url}}
 
   build-deploy:
     runs-on: ubuntu-latest
@@ -119,14 +125,18 @@ jobs:
     steps:
       - name: Check deployment path
         run: |
-          echo "Deploying to '${{ needs.setup-environment.outputs.deploy_dir }}' -- job will fail if this is empty!"
-          [ -n "${{ needs.setup-environment.outputs.deploy_dir }}" ]
+          echo "Deploying to '${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR}' -- job will fail if this is empty!"
+          [ -n "${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR}" ]
+        env:
+          NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR: ${{ needs.setup-environment.outputs.deploy_dir }}
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        with:
+          persist-credentials: false
 
       - name: Cache dependencies
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 20
           cache: "yarn"
@@ -158,12 +168,13 @@ jobs:
       - name: Deploy site to S3 bucket
         if: env.AWS_SECRET_ACCESS_KEY != ''
         run: |
-          aws s3 sync ./build/ s3://${{ secrets.AWS_S3_BUCKET }}/${{ needs.setup-environment.outputs.deploy_dir }} --endpoint ${{ secrets.AWS_ENDPOINT }} --progress-frequency 5
+          aws s3 sync ./build/ s3://${{ secrets.AWS_S3_BUCKET }}/${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR} --endpoint ${{ secrets.AWS_ENDPOINT }} --progress-frequency 5
           aws s3 sync ./build/chunks/ s3://${{ secrets.AWS_S3_BUCKET }}/chunks/ --endpoint ${{ secrets.AWS_ENDPOINT }} --exclude "*" --include "fetch-worker*" --include "mediapipe/**" --progress-frequency 5
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION: ${{ secrets.AWS_REGION }}
+          NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR: ${{ needs.setup-environment.outputs.deploy_dir }}
 
       - name: Update latest version file
         if: env.AWS_SECRET_ACCESS_KEY != '' && github.ref_type == 'tag'
@@ -174,11 +185,12 @@ jobs:
           fi
 
           # Use no-cache so latest_version is revalidated after tag deploys.
-          echo -n "${{ needs.setup-environment.outputs.deploy_dir }}" | aws s3 cp - s3://${{ secrets.AWS_S3_BUCKET }}/latest_version --endpoint ${{ secrets.AWS_ENDPOINT }} --content-type "text/plain" --cache-control "no-cache"
+          echo -n "${NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR}" | aws s3 cp - s3://${{ secrets.AWS_S3_BUCKET }}/latest_version --endpoint ${{ secrets.AWS_ENDPOINT }} --content-type "text/plain" --cache-control "no-cache"
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
           AWS_REGION: ${{ secrets.AWS_REGION }}
+          NEEDS_SETUP_ENVIRONMENT_OUTPUTS_DEPLOY_DIR: ${{ needs.setup-environment.outputs.deploy_dir }}
 
       - name: Purge Cloudflare cache
         if: env.HAS_CLOUDFLARE_SECRETS == 'true'
diff --git a/.github/workflows/dispatch-learner-experience-e2e.yml b/.github/workflows/dispatch-learner-experience-e2e.yml
index 566d93fc9..4b79ae8bb 100644
--- a/.github/workflows/dispatch-learner-experience-e2e.yml
+++ b/.github/workflows/dispatch-learner-experience-e2e.yml
@@ -28,9 +28,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 1
+          persist-credentials: false
 
       - name: Trigger learner-experience integration tests
         env:
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000..c86869303
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  cache-poisoning:
+    disable: true
+  secrets-inherit:
+    disable: true