diff --git a/.github/workflows/npm.yml b/.github/workflows/npm.yml
new file mode 100644
index 0000000..d62db22
--- /dev/null
+++ b/.github/workflows/npm.yml
@@ -0,0 +1,95 @@
+name: NPM release 🚀
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    name: Build package 📦
+    runs-on: ubuntu-26.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24.x'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+      - name: Update npm
+        run: npm install -g npm@latest  # zizmor: ignore[adhoc-packages]
+      - name: Install npm deps
+        run: npm i
+      - name: Build package 🏗
+        run: |
+          mkdir pkg
+          npm pack --pack-destination pkg
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        name: Upload build artifacts 📦
+        with:
+          name: pkg
+          retention-days: 7
+          path: ./pkg
+
+  create-github-release:
+    name: Create GitHub release 🐙
+    # Upload apackage to a GitHub release. It remains available as a build artifact for a while as well.
+    needs: build
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: write
+    steps:
+      - name: Download build artifacts 📦
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: ./pkg
+      - name: Create draft release 🐙
+        run: >-
+          gh release create
+          --verify-tag
+          --draft
+          --repo ${{ github.repository }}
+          --title ${GITHUB_REF_NAME}
+          ${GITHUB_REF_NAME}
+          pkg/*
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+  publish-npm:
+    name: Publish 🚀
+    needs: [build, create-github-release]
+    # Wait for approval before attempting to upload to NPM. This allows reviewing the files in the draft release.
+    environment: publish
+    runs-on: ubuntu-26.04
+    permissions:
+      contents: write
+      id-token: write
+    steps:
+      - name: Install Node.js
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: '24.x'
+          registry-url: 'https://registry.npmjs.org'
+          package-manager-cache: false
+      - name: Update npm
+        run: npm install -g npm@latest  # zizmor: ignore[adhoc-packages]
+      - name: Download build artifacts 📦
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          path: ./pkg
+      - name: Publish to NPM 🚀
+        run: npm publish ./pkg/*.tgz --tag latest --access public --provenance
+      - name: Publish GitHub release 🐙
+        run: >-
+          gh release edit
+          --draft=false
+          --repo ${{ github.repository }}
+          ${GITHUB_REF_NAME}
+        env:
+          GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index a2236a5..25028c3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,15 +6,19 @@ on:
   pull_request:
     branches: [master]
 
+permissions: {}
+
 jobs:
   tests:
     name: Tests
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/*
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000..69b0b53
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,27 @@
+name: Zizmor
+
+on:
+  push:
+    paths: ['.github/**/*.yml']
+    branches:
+      - master
+  pull_request:
+    paths: ['.github/**/*.yml']
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          advanced-security: false
+          annotations: true