diff --git a/.github/workflows/code-coverage.yaml b/.github/workflows/code-coverage.yaml
index 6e4cf50..c13f57c 100644
--- a/.github/workflows/code-coverage.yaml
+++ b/.github/workflows/code-coverage.yaml
@@ -21,6 +21,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Install Socket Firewall
       uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3053fad..5e4940b 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,6 +20,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Install Socket Firewall
       uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index a839416..e0cc717 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -25,6 +25,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Install Socket Firewall
       uses: SocketDev/action@ba6de6cc0565af1f42295590380973573297e31f # v1.3.2
diff --git a/DEFENSE_IN_DEPTH.md b/DEFENSE_IN_DEPTH.md
index 952f346..89ce648 100644
--- a/DEFENSE_IN_DEPTH.md
+++ b/DEFENSE_IN_DEPTH.md
@@ -27,9 +27,9 @@ Profile: npm library · public
 - [x] No `contents: write` except jobs whose purpose is mutating the repo (GitHub Release, Changesets version PR); generated output is a workflow artifact, never committed back from CI — verified 2026-09-09
 - [x] Every action pinned to a full commit SHA (`npx actions-up`) — PR #69
 - [x] Every job installs Socket Firewall (`SocketDev/action` SHA-pinned, `firewall-version` pinned); `pnpm install` / `npm install` run as `sfw pnpm install` / `sfw npm install` — PR #70
-- [ ] `.github/workflows/check-workflows.yaml` lints workflows with zizmor on every PR (PR #71 pending)
+- [x] `.github/workflows/check-workflows.yaml` lints workflows with zizmor on every PR — PR #71
 - [x] Workflow `name:` and job `name:` contain no spaces (kebab-case) so they can be set as required status checks — verified 2026-09-09
-- [ ] `persist-credentials: false` on checkouts that don't push
+- [ ] `persist-credentials: false` on checkouts that don't push (PR #72 pending)
 - [x] No `pull_request_target` on workflows that run untrusted PR code — verified 2026-09-09
 - [ ] Artifact-publishing workflows disable `actions/setup-node` default caching (`package-manager-cache: false`) to prevent cache poisoning
 - [ ] No npm tokens (or other registry credentials) in Actions secrets
diff --git a/SECURITY.md b/SECURITY.md
index a13a130..3f595e2 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -26,7 +26,7 @@ hardening checklist; progress is tracked in [DEFENSE_IN_DEPTH.md](./DEFENSE_IN_D
 - pnpm is pinned via `packageManager` (`pnpm@12.3.0`).
 - Dependencies install through pnpm with a 7-day cooldown on new versions, lifecycle scripts blocked by default, `trustPolicy: no-downgrade`, and exotic subdependencies blocked.
 - The lockfile is committed and CI installs with `--frozen-lockfile`. There is no Dependabot config; dependency updates go through reviewed PRs.
-- CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`.
+- CI workflows default to read-only `contents: read` permissions; generated output is never committed back from CI; every action is pinned to a full commit SHA; Socket Firewall (`sfw`) wraps `pnpm install`; zizmor lints workflows on every PR.
 - Workflows do not use `pull_request_target`.
 - The published package sets `repository.url` to this repo so provenance can map back.
 - `.github/CODEOWNERS` names `@jaredwray` for `/.github/`, `/.vscode/`, `/.cursor/`, `/.devcontainer/`, and `/scripts/`.