diff --git a/.github/workflows/black.yml b/.github/workflows/black.yml
index fafb34e..9f9f185 100644
--- a/.github/workflows/black.yml
+++ b/.github/workflows/black.yml
@@ -7,6 +7,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: psf/black@stable
         with:
             options: "--check --verbose"
\ No newline at end of file
diff --git a/.github/workflows/coveralls.yml b/.github/workflows/coveralls.yml
index 51205fa..aba7725 100644
--- a/.github/workflows/coveralls.yml
+++ b/.github/workflows/coveralls.yml
@@ -14,6 +14,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
       uses: actions/setup-python@v5
       with:
diff --git a/.github/workflows/cygwin.yml b/.github/workflows/cygwin.yml
index 7705188..e97f4e5 100644
--- a/.github/workflows/cygwin.yml
+++ b/.github/workflows/cygwin.yml
@@ -9,6 +9,8 @@ jobs:
         - run: git config --global core.autocrlf input
 
         - uses: actions/checkout@v4
+          with:
+            persist-credentials: false
 
         - name: Install Cygwin
           uses: cygwin/cygwin-install-action@v4
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 05257bb..a163430 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -33,6 +33,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index c8a9609..18aff05 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -23,6 +23,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index fb1d4cc..a3b35b3 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -12,6 +12,8 @@ jobs:
       id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
     - name: Set up Python 
       uses: actions/setup-python@v5
       with:
diff --git a/.github/workflows/pypy.yml b/.github/workflows/pypy.yml
index 0c26b89..646223d 100644
--- a/.github/workflows/pypy.yml
+++ b/.github/workflows/pypy.yml
@@ -12,6 +12,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
       - name: Set up PyPy
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/qemu.yml b/.github/workflows/qemu.yml
index 935e62d..2a084a9 100644
--- a/.github/workflows/qemu.yml
+++ b/.github/workflows/qemu.yml
@@ -52,6 +52,7 @@ jobs:
       with:
         submodules: recursive
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Initialize binfmt_misc for qemu-user-static
       run: |
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 81662da..9d01fb0 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -19,6 +19,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/zenodo.yml b/.github/workflows/zenodo.yml
index 98df2df..1254d29 100644
--- a/.github/workflows/zenodo.yml
+++ b/.github/workflows/zenodo.yml
@@ -7,6 +7,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - name: Set up Python 
         uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..bcc9887
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,37 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["**"]
+
+jobs:
+  zizmor:
+    name: zizmor latest via Cargo
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      # required for workflows in private repositories
+      contents: read
+      actions: read
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+      - name: Setup Rust
+        uses: actions-rust-lang/setup-rust-toolchain@v1
+      - name: Get zizmor
+        run: cargo install zizmor
+      - name: Run zizmor 🌈
+        run: zizmor --format sarif . > results.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} 
+
+
+      - name: Upload SARIF file
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: zizmor
\ No newline at end of file
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 29355f3..0e34856 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -5,3 +5,8 @@ repos:
     hooks:
       - id: black
         language_version: python3 # Should be a command that runs python3.6+
+  - repo: https://github.com/woodruffw/zizmor
+    rev: v0.7.0 
+    hooks:
+    - id: zizmor
+      files: ^.github/workflows/.*\.yml$
\ No newline at end of file