diff --git a/.github/workflows/auto-update-semconv.yml b/.github/workflows/auto-update-semconv.yml
index 9e5d0b3..8d1a6c7 100644
--- a/.github/workflows/auto-update-semconv.yml
+++ b/.github/workflows/auto-update-semconv.yml
@@ -56,6 +56,8 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_SEMANTIC_CONVENTIONS_JAVA_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_SEMANTIC_CONVENTIONS_JAVA_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cbd2276..bc3d6d2 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -38,7 +38,8 @@ jobs:
           distribution: temurin
           java-version: 21
 
-      - name: Set up gradle
+      # This workflow analyzes release branches but does not build or publish release artifacts.
+      - name: Set up gradle # zizmor: ignore[cache-poisoning]
         if: matrix.language == 'java'
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
 
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index e4c93f4..c8bf4b8 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -67,6 +67,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against the release branch
         env:
@@ -115,6 +116,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2f63d6c..3b9ef1d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -202,6 +202,7 @@ jobs:
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
           private-key: ${{ secrets.OTELBOT_PRIVATE_KEY }}
+          permission-pull-requests: write
 
       - name: Create pull request against main
         env:
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..198a576
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,20 @@
+name: Zizmor
+
+on:
+  push:
+    branches:
+      - main
+      - release/*
+  pull_request:
+  schedule:
+    - cron: '53 6 * * 4' # weekly at 06:53 UTC on Thursday
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@7c49790392da7de86fdb4bb968446f9cb8461eb8 # v0.3.1