diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7f803ee43..111f77f9f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,15 +1,21 @@
 version: 2
-enable-beta-ecosystems: true
 updates:
 - package-ecosystem: github-actions
   directory: "/"
   schedule:
-    interval: weekly
+    interval: monthly
+  cooldown:
+    default-days: 7
+  groups:
+    github-actions:
+      patterns: ["*"]
 
 - package-ecosystem: pre-commit
   directory: "/"
   schedule:
     interval: monthly
+  cooldown:
+    default-days: 7
   groups:
     pre-commit:
       patterns: ["*"]
diff --git a/.github/workflows/alpine-test.yml b/.github/workflows/alpine-test.yml
index b3558d214..14506a30a 100644
--- a/.github/workflows/alpine-test.yml
+++ b/.github/workflows/alpine-test.yml
@@ -32,9 +32,10 @@ jobs:
         adduser runner docker
       shell: sh -exo pipefail {0}  # Run this as root, not the "runner" user.
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Set workspace ownership
       run: |
diff --git a/.github/workflows/backend-benchmark.yml b/.github/workflows/backend-benchmark.yml
index d02dc73f1..49f0155a0 100644
--- a/.github/workflows/backend-benchmark.yml
+++ b/.github/workflows/backend-benchmark.yml
@@ -14,11 +14,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
       - name: Ensure Git 2.52 or newer
@@ -75,7 +75,7 @@ jobs:
             >> "$GITHUB_STEP_SUMMARY"
       - name: Retain raw timings and comparison
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: backend-benchmark
           path: benchmark-results/
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index eeb68cd0c..143c2de52 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,6 +18,8 @@ on:
   schedule:
     - cron: '27 10 * * 3'
 
+permissions: {}  # Expanded in the `analyze` job.
+
 jobs:
   analyze:
     name: Analyze (${{ matrix.language }})
@@ -28,7 +30,7 @@ jobs:
     # Consider using larger runners or machines with greater resources for possible analysis time improvements.
     runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
     permissions:
-      security-events: write
+      security-events: write  # Required for uploading SARIF to view in the Security tab.
 
     strategy:
       fail-fast: false
@@ -48,7 +50,9 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`
@@ -58,7 +62,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -90,6 +94,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/cygwin-test.yml b/.github/workflows/cygwin-test.yml
index d01676f43..938a5b740 100644
--- a/.github/workflows/cygwin-test.yml
+++ b/.github/workflows/cygwin-test.yml
@@ -28,12 +28,13 @@ jobs:
         git config --global core.autocrlf false  # Affects the non-Cygwin git.
       shell: pwsh  # Do this outside Cygwin, to affect actions/checkout.
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Install Cygwin
-      uses: cygwin/cygwin-install-action@v6
+      uses: cygwin/cygwin-install-action@3f0a3f9f988f7e96b8c18098ae05eaec175f5b52 # v6.0.2
       with:
         packages: >-
           curl gcc-core git libcurl-devel libexpat-devel libiconv-devel
diff --git a/.github/workflows/dependencies.yml b/.github/workflows/dependencies.yml
index 4eff39b3c..1b5f39c83 100644
--- a/.github/workflows/dependencies.yml
+++ b/.github/workflows/dependencies.yml
@@ -11,18 +11,28 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.os || 'ubuntu-latest' }}
     strategy:
       fail-fast: false
       matrix:
         project: [smmap, gitdb]
         python-version: ["3.8", "3.9", "3.10", "3.11", "3.12", "3.13", "3.13t"]
+        include:
+        # setup-python has no builds of these versions for Ubuntu 26.04.
+        - python-version: "3.8"
+          os: ubuntu-24.04
+        - python-version: "3.9"
+          os: ubuntu-24.04
+
+    env:
+      PROJECT: ${{ matrix.project }}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
-    - uses: actions/setup-python@v7
+        persist-credentials: false
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: true
@@ -30,20 +40,20 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         python -m pip install pytest flake8 ./smmap
-        if test "${{ matrix.project }}" = gitdb; then python -m pip install ./gitdb; fi
+        if test "$PROJECT" = gitdb; then python -m pip install ./gitdb; fi
     - name: Lint
-      run: flake8 "${{ matrix.project }}/${{ matrix.project }}" --count --select=E9,F63,F7,F82 --show-source --statistics
+      run: flake8 "$PROJECT/$PROJECT" --count --select=E9,F63,F7,F82 --show-source --statistics
     - name: Test
       run: |
-        if test "${{ matrix.project }}" = gitdb; then
+        if test "$PROJECT" = gitdb; then
           GITDB_TEST_GIT_REPO_BASE="$(git rev-parse --git-common-dir)" pytest -o addopts= -v gitdb/gitdb/test
         else
           pytest -o addopts= -v smmap/smmap/test
         fi
   uv-sync:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/downstream.yml b/.github/workflows/downstream.yml
index 9483b6586..d3069bab9 100644
--- a/.github/workflows/downstream.yml
+++ b/.github/workflows/downstream.yml
@@ -19,7 +19,7 @@ jobs:
         project: [langchain, mlflow, bandit, swebench, datahub]
         backend: [gix, cli]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Ensure Git 2.52 or newer
@@ -48,4 +48,7 @@ jobs:
           version: '0.12.13'
           enable-cache: false
       - name: Test latest release against this checkout
-        run: uv run test/downstream/run.py "${{ matrix.project }}" --backend "${{ matrix.backend }}"
+        env:
+          PROJECT: ${{ matrix.project }}
+          BACKEND: ${{ matrix.backend }}
+        run: uv run test/downstream/run.py "$PROJECT" --backend "$BACKEND"
diff --git a/.github/workflows/git-cli.yml b/.github/workflows/git-cli.yml
index 567bc9373..b104fd4f4 100644
--- a/.github/workflows/git-cli.yml
+++ b/.github/workflows/git-cli.yml
@@ -15,13 +15,16 @@ jobs:
     env:
       GIT_PYTHON_BACKEND: cli
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: git/git
           ref: v2.52.0
           path: .git-source
-      - uses: actions/setup-python@v7
+          persist-credentials: false
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: '3.12'
       - name: Build minimum supported Git
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d22640951..496f4b093 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -14,10 +14,39 @@ jobs:
     runs-on: ubuntu-slim
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
-    - uses: actions/setup-python@v7
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: "3.x"
 
-    - uses: pre-commit/action@v3.0.1
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+
+  # Check that all `actions/checkout` in CI jobs have `persist-credentials: false`.
+  check-no-persist-credentials:
+    runs-on: ubuntu-slim
+
+    env:
+      GLOB: .github/workflows/*.@(yaml|yml)
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+        sparse-checkout: ".github/workflows"
+    - name: List workflows to be scanned
+      run: |
+        shopt -s extglob
+        printf '%s\n' $GLOB  # Pathname expansion in $GLOB intended.
+    - name: Scan workflows
+      run: |
+        shopt -s extglob
+        yq '.jobs.*.steps[]
+          | select(.uses == "actions/checkout@*" and .with.["persist-credentials"]? != false)
+          | {"file": filename, "line": line, "name": (.name // .uses)}
+          | .file + ":" + (.line | tostring) + ": " + .name
+        ' -- $GLOB >query-output.txt  # Pathname expansion in $GLOB intended.
+        cat query-output.txt
+        test -z "$(<query-output.txt)"  # Report failure if we found anything.
diff --git a/.github/workflows/pythonpackage.yml b/.github/workflows/pythonpackage.yml
index 53e0e08cc..1ca50a599 100644
--- a/.github/workflows/pythonpackage.yml
+++ b/.github/workflows/pythonpackage.yml
@@ -59,12 +59,13 @@ jobs:
         shell: bash --noprofile --norc -exo pipefail {0}
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: ${{ matrix.python-version }}
         allow-prereleases: ${{ matrix.experimental }}
@@ -97,7 +98,7 @@ jobs:
 
     - name: Set up WSL (Windows)
       if: matrix.os-type == 'windows'
-      uses: Vampire/setup-wsl@v7.2.0
+      uses: Vampire/setup-wsl@4c48163d9f981914dd8caa0fc335fe19cca5bff4 # v7.2.0
       with:
         wsl-version: 1
 
@@ -206,7 +207,6 @@ jobs:
       continue-on-error: true
 
     - name: Check types with mypy
-      if: matrix.python-version != '3.8'
       run: |
         mypy --python-version="${PYTHON_VERSION%t}"  # Version only, with no "t" for free-threaded.
       env:
@@ -232,7 +232,7 @@ jobs:
 
     - name: Retain test results and backend operation counts
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: tests-${{ matrix.os-type }}-${{ matrix.python-version }}-${{ matrix.backend }}
         path: test-results/
@@ -251,11 +251,24 @@ jobs:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
         python: ["3.8", "3.9", "3.10"]
+        exclude:
+        # setup-python has no builds of these versions for Ubuntu 26.04.
+        - os: ubuntu-latest
+          python: "3.8"
+        - os: ubuntu-latest
+          python: "3.9"
+        include:
+        - os: ubuntu-24.04
+          python: "3.8"
+        - os: ubuntu-24.04
+          python: "3.9"
     env:
       GIT_PYTHON_BACKEND: cli
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-python@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+    - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
       with:
         python-version: ${{ matrix.python }}
     - name: Install the supported runtime
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 000000000..9f4512712
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,27 @@
+name: zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+permissions: {}  # Expanded in the `zizmor` job.
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-slim
+
+    permissions:
+      security-events: write  # Required for uploading SARIF to view in the Security tab.
+      contents: read  # Not needed in public repos. (Kept for private forks/reuploads.)
+      actions: read  # Not needed in public repos. (Kept for private forks/reuploads.)
+
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
+
+    - uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+      with:
+        persona: pedantic
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000..f7515d023
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,5 @@
+rules:
+  anonymous-definition:
+    disable: true
+  concurrency-limits:
+    disable: true