diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml
index 05903d8..f53656b 100644
--- a/.github/workflows/add-to-project.yml
+++ b/.github/workflows/add-to-project.yml
@@ -4,7 +4,7 @@ on:
   issues:
     types:
       - opened
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
 
diff --git a/.github/workflows/auto-fix-lint.yml b/.github/workflows/auto-fix-lint.yml
index d370124..58fbdf7 100644
--- a/.github/workflows/auto-fix-lint.yml
+++ b/.github/workflows/auto-fix-lint.yml
@@ -22,7 +22,7 @@ jobs:
       with:
         creds: ${{ secrets.GH_APP_CREDS }}
         export-git-user: true
-    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # tag: v4.1.1
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # tag: v4.1.1 # zizmor: ignore[artipacked] persisted token is intentional; needed for the git push step below
       with:
         token: ${{ steps.generate-token.outputs.token }}
     - name: Setup Node.js
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index ebd306b..2e621a8 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,6 +20,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11  # tag: v4.1.1
+      with:
+        persist-credentials: false
     - name: Setup Node.js
       uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65  # tag: v4.0.0
       with: