diff --git a/.github/workflows/build_test.yml b/.github/workflows/build_test.yml
index f6713bb..db647f4 100644
--- a/.github/workflows/build_test.yml
+++ b/.github/workflows/build_test.yml
@@ -112,13 +112,11 @@ jobs:
 
           - name: cmake-win64:msvc-rel
             build_system: cmake
-            cmake_generator: Visual Studio 17 2022
             cmake_config: Release
             os: windows-latest
 
           - name: cmake-win64:msvc-dbg
             build_system: cmake
-            cmake_generator: Visual Studio 17 2022
             cmake_config: Debug
             os: windows-latest
 
@@ -235,6 +233,7 @@ jobs:
       with:
         submodules: false
         fetch-depth: 1
+        persist-credentials: false
 
     - name: Configure / Build / Test with CMake
       if: ${{ matrix.build_system == 'cmake' }}
@@ -245,7 +244,6 @@ jobs:
         [ ! -z '${{ matrix.c_compiler || '' }}' ] && CMAKE_OPTIONS+=(-DCMAKE_C_COMPILER='${{ matrix.c_compiler }}')
         [ ! -z '${{ matrix.cxx_compiler || '' }}' ] && CMAKE_OPTIONS+=(-DCMAKE_CXX_COMPILER='${{ matrix.cxx_compiler }}')
         [ ! -z '${{ matrix.sanitizer || '' }}' ] && CMAKE_OPTIONS+=(-DENABLE_SANITIZER='${{ matrix.sanitizer }}')
-        [ ! -z '${{ matrix.cmake_generator || '' }}' ] && export CMAKE_GENERATOR='${{ matrix.cmake_generator }}'
         declare -a CMAKE_BUILD_OPTIONS=()
         [ ! -z '${{ matrix.cmake_config || '' }}' ] && CMAKE_BUILD_OPTIONS+=(--config '${{ matrix.cmake_config }}')
         declare -a CMAKE_TEST_OPTIONS=()
@@ -356,6 +354,7 @@ jobs:
       with:
         submodules: false
         fetch-depth: 1
+        persist-credentials: false
 
     - name: Build / Test
       run: |
diff --git a/.github/workflows/build_test_wasm.yml b/.github/workflows/build_test_wasm.yml
index 0c8b07c..0595f6b 100644
--- a/.github/workflows/build_test_wasm.yml
+++ b/.github/workflows/build_test_wasm.yml
@@ -43,6 +43,7 @@ jobs:
       with:
         submodules: true
         fetch-depth: 1
+        persist-credentials: false
 
     - name: Install node
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d9fa1a5..4286653 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,6 +41,8 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 2129dcb..fe030b5 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -36,17 +36,24 @@ jobs:
 
     - name: Checkout repository
       uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      with:
+        persist-credentials: false
 
     - name: Install tools
       run: |
         eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
-        brew install buildifier ruff typos-cli
+        brew install buildifier ruff typos-cli zizmor
 
     - name: Check typos
       run: |
         eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
         ./scripts/check_typos.sh
 
+    - name: Audit workflows
+      run: |
+        eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
+        zizmor ./.github/workflows
+
     - name: Lint Python code
       run: |
         eval "$(/home/linuxbrew/.linuxbrew/bin/brew shellenv)"
diff --git a/.github/workflows/publish_to_bcr.yaml b/.github/workflows/publish_to_bcr.yaml
index a0d9ef5..06d0708 100644
--- a/.github/workflows/publish_to_bcr.yaml
+++ b/.github/workflows/publish_to_bcr.yaml
@@ -19,7 +19,7 @@ jobs:
       contents: write
       id-token: write
       attestations: write
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@v2
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@005a51c75c5027e54477d290a21aa57e0a1a65f5 # 2026.07.03
     with:
       tag_name: ${{ inputs.tag_name }}
       registry_fork: ${{ inputs.registry_fork }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index bb32037..e38c9e4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -73,21 +73,25 @@ jobs:
       with:
         submodules: false
         fetch-depth: 1
+        persist-credentials: false
 
     - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+      if: github.event_name != 'release'
       id: cache-vcpkg
       with:
         path: vcpkg
         key: release-${{ runner.os }}-vcpkg-${{ env.VCPKG_VERSION }}-${{ matrix.triplet }}
+        # TODO(eustas): remove when https://github.com/zizmorcore/zizmor/issues/2071 is fixed
+        lookup-only: ${{ startsWith(github.ref, 'refs/tags/') }}
 
     - name: Download vcpkg
-      if: steps.cache-vcpkg.outputs.cache-hit != 'true'
+      if: github.event_name == 'release' || steps.cache-vcpkg.outputs.cache-hit != 'true'
       shell: 'powershell'
       run: |
         Invoke-WebRequest -Uri "https://github.com/microsoft/vcpkg/archive/refs/tags/${{ env.VCPKG_VERSION }}.zip" -OutFile "vcpkg.zip"
 
     - name: Bootstrap vcpkg
-      if: steps.cache-vcpkg.outputs.cache-hit != 'true'
+      if: github.event_name == 'release' || steps.cache-vcpkg.outputs.cache-hit != 'true'
       shell: 'bash'
       run: |
         set -x
@@ -154,6 +158,7 @@ jobs:
       with:
         submodules: false
         fetch-depth: 1
+        persist-credentials: false
 
     - name: Compress testdata
       run: |
@@ -180,6 +185,7 @@ jobs:
       with:
         submodules: false
         fetch-depth: 1
+        persist-credentials: false
 
     - name: Download all artifacts
       uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -190,8 +196,9 @@ jobs:
     - name: Publish assets
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
       run: |
-        gh release upload ${{ github.event.release.tag_name }} ./release_assets/*
+        gh release upload ${GITHUB_EVENT_RELEASE_TAG_NAME} ./release_assets/*
 
   archive_build:
     needs: publish_release_assets
@@ -212,6 +219,7 @@ jobs:
       with:
         submodules: false
         fetch-depth: 1
+        persist-credentials: false
 
     - name: Archive
       run: |