diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1ab5e3..4a87d68 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,6 +36,8 @@ jobs:
             cache: true
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           install_args: rust
@@ -43,12 +45,34 @@ jobs:
         if: ${{ matrix.cache }}
       - run: ${{ matrix.command }}
 
+  workflow-lint:
+    name: Workflow Lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
+        with:
+          install_args: actionlint zizmor aqua:oxc-project/oxc/oxfmt
+      - name: actionlint
+        run: actionlint
+      - name: zizmor
+        run: zizmor .github/workflows/
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: oxfmt
+        run: oxfmt --check .
+
   compile-test:
     name: Compile Test
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
       - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
       - name: Build typdiff
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9c1da22..9abe41b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,7 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: write
+  contents: read
 
 env:
   CARGO_TERM_COLOR: always
@@ -38,9 +38,12 @@ jobs:
             cross: false
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           install_args: rust
+          cache: false
       - name: Add build target
         if: "!matrix.cross"
         run: rustup target add ${{ matrix.target }}
@@ -75,6 +78,8 @@ jobs:
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 10
+    permissions:
+      contents: write
     steps:
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
@@ -98,9 +103,12 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           install_args: rust
+          cache: false
       - name: Authenticate with crates.io
         id: auth
         uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..0a22b8d
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  superfluous-actions:
+    ignore:
+      # action-gh-release is kept for generate_release_notes and asset handling.
+      - release.yml
diff --git a/mise.toml b/mise.toml
index 5a9e4a0..10f955c 100644
--- a/mise.toml
+++ b/mise.toml
@@ -1,3 +1,7 @@
 [tools]
 rust = { version = "1.97.1", components = "rustfmt,clippy" }
 typst = "0.15.1"
+actionlint = "1.7.12"
+zizmor = "1.28.0"
+# apps_v* release tag of the oxc monorepo; ships oxfmt 0.62.0
+"aqua:oxc-project/oxc/oxfmt" = "1.77.0"
diff --git a/renovate.json b/renovate.json
index f4a02d8..85d1e54 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,10 +1,6 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:best-practices",
-    ":timezone(Asia/Tokyo)",
-    "schedule:weekly"
-  ],
+  "extends": ["config:best-practices", ":timezone(Asia/Tokyo)", "schedule:weekly"],
   "minimumReleaseAge": "7 days",
   "lockFileMaintenance": {
     "enabled": true