diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index e6f502c..d74f061 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -17,6 +17,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "pip"
     directory: "/"
     target-branch: "dev"
@@ -34,6 +36,8 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "github-actions"
     directory: "/"
     target-branch: "dev"
@@ -51,3 +55,5 @@ updates:
           - "*"
         update-types:
           - "major"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index e30d6f9..edcd49f 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -1,9 +1,10 @@
 name: CLA
 
+# The CLA bot needs both triggers; cla-reusable.yml never checks out pull request code.
 on:
-  issue_comment:
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [opened, closed, synchronize]
 
 permissions:
diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml
new file mode 100644
index 0000000..b674f80
--- /dev/null
+++ b/.github/workflows/dev-security.yml
@@ -0,0 +1,11 @@
+name: dev-security
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@12139195c6f35d8b4478bb8ec3df94aa275da01e # v1.1.0
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 52d51fc..5313082 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,14 +25,14 @@ jobs:
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/tests.yml
+    uses: ./.github/workflows/tests.yml # zizmor: ignore[self-repository]
 
   rust-tests:
     needs: check
     if: needs.check.outputs.release == 'true'
     permissions:
       contents: read
-    uses: ./.github/workflows/rust-tests.yml
+    uses: ./.github/workflows/rust-tests.yml # zizmor: ignore[self-repository]
 
   wheels:
     needs: [tests, rust-tests]