diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3636c1c..81d9971 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,19 +18,25 @@ jobs:
     name: Parse tag
     permissions:
       contents: read
+      id-token: write
     runs-on: ubuntu-latest
     outputs:
       packages: ${{ steps.parse.outputs.packages }}
       version: ${{ steps.parse.outputs.version }}
       release_tag: ${{ steps.parse.outputs.release_tag }}
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - name: Parse release version from tag
         id: parse
         shell: bash
+        env:
+          INPUT_RELEASE_TAG: ${{ inputs.release_tag }}
         run: |
           set -euo pipefail
 
-          TAG="${{ inputs.release_tag }}"
+          TAG="$INPUT_RELEASE_TAG"
           if [ -z "$TAG" ]; then
             TAG="${GITHUB_REF#refs/tags/}"
           fi
@@ -99,6 +105,9 @@ jobs:
       TEMPO_WALLET_PACKAGE_DIR: artifacts
       TEMPO_WALLET_PACKAGE_OUTPUT: artifacts/${{ matrix.package }}-${{ matrix.build.suffix }}
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.parse-tag.outputs.release_tag }}
@@ -135,7 +144,7 @@ jobs:
 
       - name: Smoke test host binary
         if: matrix.build.pkg_target == 'node22-linux-x64' || matrix.build.pkg_target == 'node22-linux-arm64' || matrix.build.pkg_target == 'node22-macos-arm64'
-        run: ./artifacts/${PACKAGE}-${{ matrix.build.suffix }} --version
+        run: ./artifacts/"${PACKAGE}"-${{ matrix.build.suffix }} --version
 
       - name: Generate sha256
         shell: bash
@@ -196,6 +205,7 @@ jobs:
     environment: release
     permissions:
       contents: write
+      id-token: write
     needs: [parse-tag, build]
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch' && !startsWith(needs.parse-tag.outputs.release_tag, 'refs/heads/')
@@ -211,6 +221,9 @@ jobs:
       AWS_MAX_ATTEMPTS: "10"
       AWS_REQUEST_CHECKSUM_CALCULATION: when_required
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ needs.parse-tag.outputs.release_tag }}
@@ -384,12 +397,16 @@ jobs:
     environment: release
     permissions:
       contents: write
+      id-token: write
     needs: [parse-tag, publish]
     runs-on: ubuntu-latest
     if: github.event_name == 'workflow_dispatch' && !startsWith(needs.parse-tag.outputs.release_tag, 'refs/heads/')
     env:
       RELEASE_TAG: ${{ needs.parse-tag.outputs.release_tag }}
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - name: Publish draft release
         env:
           GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/changelog-generate.yml b/.github/workflows/changelog-generate.yml
index 5f6a8b0..6bb1e1d 100644
--- a/.github/workflows/changelog-generate.yml
+++ b/.github/workflows/changelog-generate.yml
@@ -16,6 +16,9 @@ jobs:
     permissions:
       id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - name: Determine PR source
         id: source
         env:
@@ -78,6 +81,7 @@ jobs:
 
       - name: Install changelog dependencies
         if: steps.source.outputs.same_repo == 'true' && steps.existing.outputs.found == 'false'
+        # zizmor: ignore[adhoc-packages] -- workflow-only CLI
         run: |
           corepack enable
           corepack prepare pnpm@11.0.8 --activate
@@ -169,8 +173,12 @@ jobs:
     if: always() && startsWith(github.event.label.name, 'changelog:')
     runs-on: ubuntu-latest
     permissions:
+      id-token: write
       pull-requests: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - name: Comment for fork PRs
         if: github.event.pull_request.head.repo.full_name != github.repository
         env:
diff --git a/.github/workflows/changelog.yml b/.github/workflows/changelog.yml
index 0115629..38c0ca8 100644
--- a/.github/workflows/changelog.yml
+++ b/.github/workflows/changelog.yml
@@ -12,7 +12,13 @@ permissions:
 jobs:
   check:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5a3020e..22204f1 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,13 @@ jobs:
     if: always()
     needs: [code, types, tests]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - name: Check required jobs
         run: |
           if [[ "${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}" == "true" ]]; then
@@ -30,7 +36,13 @@ jobs:
   code:
     name: Code
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -53,7 +65,13 @@ jobs:
   types:
     name: Types
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
@@ -79,7 +97,13 @@ jobs:
   tests:
     name: Tests
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
diff --git a/.github/workflows/dependency-scan.yml b/.github/workflows/dependency-scan.yml
new file mode 100644
index 0000000..30c2e17
--- /dev/null
+++ b/.github/workflows/dependency-scan.yml
@@ -0,0 +1,13 @@
+name: Dependency Scan
+
+"on":
+  pull_request:
+
+permissions: {}
+
+jobs:
+  dependency-scan:
+    uses: tempoxyz/gh-actions/.github/workflows/dependency-scan.yml@25cce154e7fb10f99361a166468a6c56b9c31aa3
+    permissions:
+      contents: read
+      id-token: write
diff --git a/.github/workflows/friction-log.yml b/.github/workflows/friction-log.yml
index ff4050f..afe96c4 100644
--- a/.github/workflows/friction-log.yml
+++ b/.github/workflows/friction-log.yml
@@ -22,10 +22,14 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: write
+      id-token: write
       issues: write
       pull-requests: write
 
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - name: Clone repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f213119..e226da9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,6 +24,9 @@ jobs:
       contents: read
       id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
@@ -91,7 +94,11 @@ jobs:
     permissions:
       actions: write
       contents: write
+      id-token: write
     steps:
+      - name: Secure runner
+        uses: tempoxyz/gh-actions/actions/secure-runner@05c669ce878b8719779a28fe7375ba85822403f8
+
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
diff --git a/.github/workflows/scan-github-actions.yml b/.github/workflows/scan-github-actions.yml
new file mode 100644
index 0000000..6c7913e
--- /dev/null
+++ b/.github/workflows/scan-github-actions.yml
@@ -0,0 +1,25 @@
+name: Scan GitHub Actions
+
+on:
+  pull_request:
+    paths:
+      - ".github/**"
+  push:
+    branches:
+      - main
+    paths:
+      - ".github/**"
+  schedule:
+    - cron: "17 9 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  scan:
+    if: ${{ github.event_name != 'schedule' || github.repository == 'tempoxyz/wallet-cli' }}
+    uses: tempoxyz/gh-actions/.github/workflows/scan-github-actions.yml@6a4184039b7a7537d35ace0badc96764d5a1d4d0
+    permissions:
+      actions: read
+      contents: read
+      id-token: write