diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5d9b07c9a..ec53923e8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -102,13 +102,14 @@ jobs:
           flags: -ignore action\s.\$/\S+.\sin\sinvalid\sformat
 
       # Static security audit of workflows and composite actions; config in
-      # .github/zizmor.yml. Informational findings do not fail the job.
+      # .github/zizmor.yml. Findings at low severity and above fail the job.
       - name: zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           advanced-security: false
           annotations: true
           min-severity: low
+          version: v1.30.0
 
       - name: Workflow invariants
         run: ./scripts/workflow-lint.sh
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 99c1bef20..84efa73d1 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -120,7 +120,7 @@ jobs:
       # `npx --yes`; a pinned Chrome via PUPPETEER_EXECUTABLE_PATH sidesteps it.
       - name: Install Chrome
         id: chrome
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
         with:
           chrome-version: stable
 
@@ -177,6 +177,6 @@ jobs:
   # this commit and runs htmltest on the output. A no-op until docker/docs
   # imports github.com/docker/docker-agent (issue #3371, Phase 2.1).
   upstream:
-    uses: docker/docs/.github/workflows/validate-upstream.yml@9955a341f1720b8923172e2b099f71d75c3e8570 # main
+    uses: docker/docs/.github/workflows/validate-upstream.yml@920ee0bb1e638c6a39d7c2a1075fa2b1d8f451a7 # main
     with:
       module-name: docker/docker-agent
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 2a7448694..5265ab948 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -4,3 +4,7 @@ rules:
     # trigger workflow runs with no permissions and only uploads event context.
     ignore:
       - pr-review.yml
+  ref-version-mismatch:
+    # docker/docs pins a moving main revision while retaining its branch label.
+    ignore:
+      - docs.yml