diff --git a/.github/workflows/rust-build.yml b/.github/workflows/rust-build.yml
index 259db8f..38c24df 100644
--- a/.github/workflows/rust-build.yml
+++ b/.github/workflows/rust-build.yml
@@ -93,4 +93,4 @@ jobs:
       - name: Publish to crates.io
         if: ${{ inputs.publish-crates-io }}
         working-directory: ${{ inputs.working-directory }}
-        run: cargo publish --locked
+        run: cargo publish --locked # zizmor: ignore[use-trusted-publishing] TODO fix this if you need to publish on crates.io
diff --git a/mise.lock b/mise.lock
index 0faeacf..ba67fcf 100644
--- a/mise.lock
+++ b/mise.lock
@@ -89,6 +89,53 @@ checksum = "sha256:8a4e35ab0b331c85d73567b12f2a444df187f483e5079ceffa6bda1faa2e7
 url = "https://github.com/koalaman/shellcheck/releases/download/v0.11.0/shellcheck-v0.11.0.zip"
 url_api = "https://api.github.com/repos/koalaman/shellcheck/releases/assets/279056944"
 
+[[tools."aqua:zizmor"]]
+version = "1.30.1"
+backend = "aqua:zizmor"
+specifiers = ["1.30.1"]
+
+[tools."aqua:zizmor"."platforms.linux-arm64"]
+checksum = "sha256:7ff1dce33bdd18fd2a4affe63bdd47efcccca97b2cec1c1863ec26e9e2647540"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067643"
+provenance = "github-attestations"
+
+[tools."aqua:zizmor"."platforms.linux-arm64-musl"]
+checksum = "sha256:7ff1dce33bdd18fd2a4affe63bdd47efcccca97b2cec1c1863ec26e9e2647540"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067643"
+provenance = "github-attestations"
+
+[tools."aqua:zizmor"."platforms.linux-x64"]
+checksum = "sha256:e65324f4430c2717591937edcec90ccbefaf14c174f8ec9415e03ca875b46e1a"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067642"
+provenance = "github-attestations"
+
+[tools."aqua:zizmor"."platforms.linux-x64-musl"]
+checksum = "sha256:e65324f4430c2717591937edcec90ccbefaf14c174f8ec9415e03ca875b46e1a"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067642"
+provenance = "github-attestations"
+
+[tools."aqua:zizmor"."platforms.macos-arm64"]
+checksum = "sha256:e28d22b087f9ebb8d99da6e740d348c930f559961c7c3f12badda54f882195a2"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-aarch64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067640"
+provenance = "github-attestations"
+
+[tools."aqua:zizmor"."platforms.macos-x64"]
+checksum = "sha256:10e6b18b11ea07e515a16f0f0518c7b07527bc9977c1fd5698181ce7f3554202"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-apple-darwin.tar.gz"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067641"
+provenance = "github-attestations"
+
+[tools."aqua:zizmor"."platforms.windows-x64"]
+checksum = "sha256:b183b1e996eddfab9659f1e9b46e059f1ef1cf984a1f14e5da09f7876a4b3a1c"
+url = "https://github.com/zizmorcore/zizmor/releases/download/v1.30.1/zizmor-x86_64-pc-windows-msvc.zip"
+url_api = "https://api.github.com/repos/zizmorcore/zizmor/releases/assets/552067645"
+provenance = "github-attestations"
+
 [[tools."npm:prettier"]]
 version = "3.9.8"
 aube = { path = ".mise/locks/npm-prettier/3.9.8", digest = "sha256:5c76115168054cd13c6ad573ac7befc182bce737bc8bca3ed27b8287e2611eeb" }
diff --git a/mise.toml b/mise.toml
index b7b2656..732a23b 100644
--- a/mise.toml
+++ b/mise.toml
@@ -5,6 +5,7 @@ lockfile = true
 [tools]
 "aqua:actionlint" = "1.7.12"
 "aqua:koalaman/shellcheck" = "0.11.0"
+"aqua:zizmor" = "1.30.1"
 "npm:prettier" = "3.9.8"
 
 [tasks.format]
@@ -32,6 +33,9 @@ run = "prettier --check ."
 description = "Lint GitHub Actions workflows with actionlint"
 run = "actionlint"
 
+[tasks."lint:zizmor"]
+run = "zizmor .github"
+
 [tasks."lint:shellcheck"]
 description = "Lint shell scripts with shellcheck"
 shell = "bash -euo pipefail -c"
@@ -39,7 +43,7 @@ run = "git ls-files -z --cached --others --exclude-standard '*.sh' | xargs -0 -r
 
 [tasks.lint]
 description = "Run all linters"
-depends = [ "lint:format", "lint:actionlint", "lint:shellcheck" ]
+depends = [ "lint:format", "lint:actionlint", "lint:shellcheck", "lint:zizmor" ]
 
 [tasks."verify-all"]
 description = "Run all lints and checks (as in CI)"
diff --git a/rust-build/workflow-sha256 b/rust-build/workflow-sha256
index 074a5fe..6c1c4eb 100644
--- a/rust-build/workflow-sha256
+++ b/rust-build/workflow-sha256
@@ -1 +1 @@
-d7dda2c72a42adb7818175d14d51fafbe7c2d53ec73119bbacd14ebfab36db60
+9c86939ba17005dd0d73804927173e9ac9f3e2abebd93ae4f81d510d654a42e8