diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 2e5b463..f469b8d 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -16,4 +16,4 @@ jobs:
   validate:
     permissions:
       contents: read
-    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@9c4075a1057c2853a339517fde4063ceccfce861 # main
+    uses: gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml@main
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..b22a2a2
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "*": hash-pin
+        "gitify-app/renovate-config/.github/workflows/renovate-config-validator.yml": ref-pin