diff --git a/.github/workflows/check-pr-template.yml b/.github/workflows/check-pr-template.yml
index 9196bac..94ad57d 100644
--- a/.github/workflows/check-pr-template.yml
+++ b/.github/workflows/check-pr-template.yml
@@ -4,7 +4,11 @@ on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
+permissions: {}
+
 jobs:
   check-pr-template:
     name: Check PR template
     uses: beeware/.github/.github/workflows/pr-checklist.yml@main
+    permissions:
+      contents: read
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7c10fc3..3bf099e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,16 +18,22 @@ defaults:
 env:
   FORCE_COLOR: "1"
 
+permissions: {}
+
 jobs:
   pre-commit:
     name: Pre-commit checks
     uses: beeware/.github/.github/workflows/pre-commit-run.yml@main
+    permissions:
+      contents: read
     with:
       pre-commit-source: "pre-commit"
 
   unit-tests:
     name: Unit tests
     needs: pre-commit
+    permissions:
+      contents: read
     runs-on: ${{ matrix.runs-on }}
     strategy:
       fail-fast: false
@@ -112,12 +118,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Set up Python
-        uses: actions/setup-python@v7.0.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         if: matrix.python-version != 'system'
         with:
           python-version: ${{ matrix.python-version }}
@@ -137,7 +144,7 @@ jobs:
         run: briefcase package ${{ matrix.briefcase-target }} --update --adhoc-sign
 
       - name: Upload Logs
-        uses: actions/upload-artifact@v7.0.1
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
         if: failure()
         with:
           name: build-failure-logs-${{ matrix.backend }}-${{ matrix.python-version }}
diff --git a/.github/workflows/new-issue.yml b/.github/workflows/new-issue.yml
index e4a99c0..cb61866 100644
--- a/.github/workflows/new-issue.yml
+++ b/.github/workflows/new-issue.yml
@@ -7,12 +7,14 @@ on:
       - reopened
       - transferred
 
+permissions: {}
+
 jobs:
   add-to-project:
     name: Add issue to BeeWare project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd  # v2.0.0
         with:
           project-url: https://github.com/orgs/beeware/projects/1
           github-token: ${{ secrets.BRUTUS_PAT_TOKEN }}
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..b834aff
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,9 @@
+rules:
+  unpinned-uses:
+    config:
+      # Allow BeeWare-provided actions to be unpinned. If an attacker is in a
+      # position to exploit those action, they're probably able to exploit
+      # repositories directly; and it's significantly easier for our internal
+      # actions to automatically be the most recent versions.
+      policies:
+        beeware/*: ref-pin
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 01a4858..9c5b3be 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -27,3 +27,7 @@ repos:
       # remove toml extra once Python 3.10 is no longer supported
       additional_dependencies: ['.[toml]']
       args: ["--skip=CODE_OF_CONDUCT.md"]
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.31.1
+    hooks:
+      - id: zizmor