diff --git a/.github/workflows/upgrade-uv-lock.yml b/.github/workflows/upgrade-uv-lock.yml
index af49bb3..300b0b9 100644
--- a/.github/workflows/upgrade-uv-lock.yml
+++ b/.github/workflows/upgrade-uv-lock.yml
@@ -10,8 +10,10 @@ on:
   - cron: 37 11 * * 1
   workflow_dispatch:
 
+permissions: {}  # disable all GitHub permissions for the workflow
+
 jobs:
-  upgrade-requirements:
+  upgrade-requirements: # zizmor:ignore[excessive-permissions]
     name: Upgrade uv.lock
     runs-on: ubuntu-latest
     if: github.repository == 'PlasmaPy/pyfaradaycup'
@@ -78,4 +80,3 @@ jobs:
         branch: upgrade-uv-lock
         base: main
         delete-branch: true
-        token: ${{ steps.generate_token.outputs.token }}
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..20384ce
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,21 @@
+# zizmor finds potential security vulnerabilities in GitHub workflow
+# files. Documentation: https://woodruffw.github.io/zizmor
+
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        astral-sh/setup-uv: ref-pin
+        codecov/codecov-action: ref-pin
+        conda-incubator/setup-miniconda: ref-pin
+        mamba-org/setup-micromamba: ref-pin
+        heliophysicsPy/pyhc-actions/*: ref-pin
+        pypa/*: ref-pin
+        scientific-python/*: ref-pin
+        ts-graphviz/setup-graphviz: ref-pin
+
+# Put settings that we intend to fix later on below this line. If we
+# decide that a potential security vulnerability does not necessitate a
+# fix, append a comment like `# zizmor: ignore[unpinned-uses]` to the
+# line or set the appropriate configuration options above.
diff --git a/noxfile.py b/noxfile.py
index e4a2fdd..d53e259 100644
--- a/noxfile.py
+++ b/noxfile.py
@@ -24,6 +24,7 @@
 import os
 
 import nox
+import nox.command
 import nox_uv
 
 nox.options.default_venv_backend = "uv"