diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..6b3d3c9
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,50 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'voidzero-dev/setup-vp@v1.22.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'googleapis/release-please-action@v5.0.0'
+        - 'voidzero-dev/setup-vp@v1.22.0'
+    '.github/workflows/renovate.yml': []
+    '.github/workflows/zizmor.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'zizmorcore/zizmor-action@v0.8.0'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'github/codeql-action@24c54180a607b1449ed407dd24f251e4e9147c8d':
+        ref: 'v4.38.3'
+        commit: 'sha1-24c54180a607b1449ed407dd24f251e4e9147c8d'
+        owner_id: 9919
+        repo_id: 259445878
+    'googleapis/release-please-action@v5.0.0':
+        ref: 'v5.0.0'
+        commit: 'sha1-45996ed1f6d02564a971a2fa1b5860e934307cf7'
+        owner_id: 16785467
+        repo_id: 262236530
+    'voidzero-dev/setup-vp@v1.22.0':
+        ref: 'v1.22.0'
+        commit: 'sha1-cab1ab9eaff52d4857875f4f2c016e36af8f2c76'
+        owner_id: 149750581
+        repo_id: 1133264797
+    'zizmorcore/zizmor-action@v0.8.0':
+        ref: 'v0.8.0'
+        commit: 'sha1-53290badfa369cb0bf7ad16342cb62c2fa47ac7b'
+        owner_id: 210636713
+        repo_id: 985558803
+        uses:
+            - 'github/codeql-action@24c54180a607b1449ed407dd24f251e4e9147c8d'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 785d39d..8540b21 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
       - name: Build isolated GNOME desktop
@@ -46,12 +46,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@cab1ab9eaff52d4857875f4f2c016e36af8f2c76 # v1.22.0
+        uses: voidzero-dev/setup-vp@v1.22.0
         with:
           node-version-file: .nvmrc
           cache: true
@@ -73,7 +73,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           sparse-checkout: .github/
@@ -90,12 +90,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@cab1ab9eaff52d4857875f4f2c016e36af8f2c76 # v1.22.0
+        uses: voidzero-dev/setup-vp@v1.22.0
         with:
           node-version-file: .nvmrc
           cache: true
@@ -104,7 +104,7 @@ jobs:
         run: vp run bundle
 
       - name: Upload extension bundle
-        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: gitify-shell-extension
           path: dist/*.shell-extension.zip
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c97013a..f62a221 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Run release-please
         id: release
-        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        uses: googleapis/release-please-action@v5.0.0
 
   publish:
     name: Attach extension bundle
@@ -36,13 +36,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
           persist-credentials: false
 
       - name: Setup Vite+
-        uses: voidzero-dev/setup-vp@cab1ab9eaff52d4857875f4f2c016e36af8f2c76 # v1.22.0
+        uses: voidzero-dev/setup-vp@v1.22.0
         with:
           cache: true
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index e642277..8b83231 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -20,9 +20,9 @@ jobs:
       actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
     steps:
       - name: Checkout repository
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        uses: zizmorcore/zizmor-action@v0.8.0
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index c0ab152..6bc9aec 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -2,6 +2,6 @@ rules:
   unpinned-uses:
     config:
       policies:
-        '*': hash-pin
-        # Permit a mutable ref only for the trusted shared validator.
-        gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml: ref-pin
+        # .github/workflows/actions.lock pins each action ref to a commit.
+        # Restore hash-pin once a zizmor release reads the lockfile (zizmorcore/zizmor#2477).
+        '*': ref-pin