diff --git a/.github/workflows/arewefastyet_comment.yml b/.github/workflows/arewefastyet_comment.yml
index bc9eca05ae1..e9c0386e7dd 100644
--- a/.github/workflows/arewefastyet_comment.yml
+++ b/.github/workflows/arewefastyet_comment.yml
@@ -4,7 +4,7 @@ name: arewefastyet comment
 permissions: read-all
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] never checks out or runs PR code
     types: [labeled]
 
 jobs:
diff --git a/.github/workflows/assign_milestone.yml b/.github/workflows/assign_milestone.yml
index 930d2831014..676d01be063 100644
--- a/.github/workflows/assign_milestone.yml
+++ b/.github/workflows/assign_milestone.yml
@@ -1,7 +1,7 @@
 name: Assign Milestone
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] only checks out the base ref, never PR code
     types: [opened]
 
 permissions:
diff --git a/.github/workflows/check_make_vtadmin_web_proto.yml b/.github/workflows/check_make_vtadmin_web_proto.yml
index 3f8af037cc0..33f3da95fb7 100644
--- a/.github/workflows/check_make_vtadmin_web_proto.yml
+++ b/.github/workflows/check_make_vtadmin_web_proto.yml
@@ -64,7 +64,13 @@ jobs:
 
     - name: Setup Node
       if: steps.changes.outputs.proto_changes == 'true'
+<<<<<<< HEAD
       uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+=======
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0  # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
+>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
       with:
         # node-version should match package.json
         node-version: '22.13.1'
diff --git a/.github/workflows/cluster_endtoend.yml b/.github/workflows/cluster_endtoend.yml
index 8eec9356f61..f18914bffdc 100644
--- a/.github/workflows/cluster_endtoend.yml
+++ b/.github/workflows/cluster_endtoend.yml
@@ -182,6 +182,28 @@ jobs:
         if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'minio')
         uses: ./.github/actions/setup-minio
 
+<<<<<<< HEAD
+||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
+      # 'consul' is the only need that triggers `make tools`, which installs both Consul and ZooKeeper.
+      # There is no separate 'zookeeper' need, so 'consul' is the correct proxy for "this shard needs ZooKeeper".
+      - name: Cache ZooKeeper
+        if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul')
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: dist/vt-zookeeper-*
+          key: zookeeper-${{ hashFiles('build.env', 'bootstrap.sh') }}
+
+=======
+      # 'consul' is the only need that triggers `make tools`, which installs both Consul and ZooKeeper.
+      # There is no separate 'zookeeper' need, so 'consul' is the correct proxy for "this shard needs ZooKeeper".
+      - name: Cache ZooKeeper
+        if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul')
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0  # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
+        with:
+          path: dist/vt-zookeeper-*
+          key: zookeeper-${{ hashFiles('build.env', 'bootstrap.sh') }}
+
+>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
       - name: Install Consul and ZooKeeper
         if: steps.changes.outputs.end_to_end == 'true' && contains(matrix.needs, 'consul')
         run: make BUILD_PROTOC=0 tools
diff --git a/.github/workflows/pr_opened_tasks.yml b/.github/workflows/pr_opened_tasks.yml
index 307e4c34bcf..f877bb94050 100644
--- a/.github/workflows/pr_opened_tasks.yml
+++ b/.github/workflows/pr_opened_tasks.yml
@@ -7,7 +7,7 @@ permissions:
   contents: read
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] only checks out the base ref, never PR code
     types: [opened]
 
 jobs:
diff --git a/.github/workflows/static_checks_etc.yml b/.github/workflows/static_checks_etc.yml
index 9786aeccf18..ab809f6d37f 100644
--- a/.github/workflows/static_checks_etc.yml
+++ b/.github/workflows/static_checks_etc.yml
@@ -222,7 +222,13 @@ jobs:
 
       - name: Setup Node
         if: steps.changes.outputs.proto_changes == 'true'
+<<<<<<< HEAD
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+=======
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0  # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
+>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
         with:
           # make proto requires newer node than the pre-installed one
           node-version: '22.13.1'
@@ -251,3 +257,9 @@ jobs:
           echo "$output"
           echo ""
           exit 1
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        with:
+          advanced-security: false
+          annotations: true
diff --git a/.github/workflows/vtadmin_web_build.yml b/.github/workflows/vtadmin_web_build.yml
index 93483d4d75f..7fdad7fdaee 100644
--- a/.github/workflows/vtadmin_web_build.yml
+++ b/.github/workflows/vtadmin_web_build.yml
@@ -42,7 +42,13 @@ jobs:
       - name: Tune the OS
         uses: ./.github/actions/tune-os
 
+<<<<<<< HEAD
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+=======
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0  # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
+>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
         with:
           # node-version should match package.json
           node-version: '22.13.1'
diff --git a/.github/workflows/vtadmin_web_lint.yml b/.github/workflows/vtadmin_web_lint.yml
index e76de429a91..116e53b9e8e 100644
--- a/.github/workflows/vtadmin_web_lint.yml
+++ b/.github/workflows/vtadmin_web_lint.yml
@@ -42,7 +42,13 @@ jobs:
       - name: Tune the OS
         uses: ./.github/actions/tune-os
 
+<<<<<<< HEAD
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+=======
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0  # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
+>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
         with:
           # node-version should match package.json
           node-version: '22.13.1'
diff --git a/.github/workflows/vtadmin_web_unit_tests.yml b/.github/workflows/vtadmin_web_unit_tests.yml
index f3b9b1aa3cb..254f89c6177 100644
--- a/.github/workflows/vtadmin_web_unit_tests.yml
+++ b/.github/workflows/vtadmin_web_unit_tests.yml
@@ -37,7 +37,13 @@ jobs:
       - name: Tune the OS
         uses: ./.github/actions/tune-os
 
+<<<<<<< HEAD
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+||||||| parent of 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+=======
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0  # zizmor: ignore[cache-poisoning] this workflow publishes no artifacts
+>>>>>>> 74844882a2 (Add `zizmor` check to the static checks workflow (#19149))
         with:
           # node-version should match package.json
           node-version: '22.13.1'