diff --git a/.github/workflows/test-suite.yml b/.github/workflows/ci.yml
similarity index 60%
rename from .github/workflows/test-suite.yml
rename to .github/workflows/ci.yml
index 091df20..417e056 100644
--- a/.github/workflows/test-suite.yml
+++ b/.github/workflows/ci.yml
@@ -10,7 +10,25 @@ on:
     branches: [ main ]
 
 jobs:
-  ci:
+  # Statically audits GitHub Actions workflows for security issues (e.g. injection
+  # risks, overly broad permissions, unpinned actions). See README.md's Developing
+  # section for how to run zizmor locally and auto-fix findings.
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read # Only needed for private repos. Needed to clone the repo.
+      actions: read # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+  codeqa:
     runs-on: ubuntu-latest
     strategy:
       matrix:
diff --git a/README.md b/README.md
index 339a6df..a8bda07 100644
--- a/README.md
+++ b/README.md
@@ -105,6 +105,31 @@ To run the test suite, you can use the following command:
 uv run pytest -v test/
 ```
 
+To lint the code with `flake8`:
+
+```bash
+uv run flake8 openleadr/ --count --select=E9,F63,F7,F82 --show-source --statistics
+```
+
+We also run [zizmor](https://github.com/zizmorcore/zizmor) in CI to statically
+audit our GitHub Actions workflows for security issues (e.g. injection risks,
+overly broad permissions, unpinned actions). You can run it locally without
+installing it, using `uvx`:
+
+```bash
+uvx zizmor .
+```
+
+Some findings can be fixed automatically:
+
+```bash
+# Apply only safe fixes
+uvx zizmor --fix .
+
+# Apply all fixes, including unsafe ones (review the diff afterwards)
+uvx zizmor --fix=all .
+```
+
 ## Contributing Documentation
 
 ### Building the documentation