diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 27315cd3..c7dc23b3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -95,6 +95,11 @@ jobs:
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
+          # The action resolves `version` (default "latest") through the digest
+          # map checked in at its pinned SHA, so this stays stable either way —
+          # the explicit pin keeps the release from shifting when the action SHA
+          # is bumped, and matches the .mise.toml zizmor pin for local parity.
+          version: "1.29.0"
           advanced-security: false
 
   security:
diff --git a/.mise.toml b/.mise.toml
index ad684612..b8f1e97e 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -2,3 +2,14 @@
 go = "1.26"
 # Keep in sync with .github/workflows/release.yml GoReleaser CLI version pin.
 goreleaser = "2.15.4"
+# Keep in sync with .github/workflows/test.yml rhysd/actionlint version pin.
+actionlint = "1.7.12"
+# Not invoked directly; actionlint shells out to it to lint workflow `run:`
+# scripts (CI uses the runner's preinstalled shellcheck).
+shellcheck = "0.11.0"
+# No CI pin to match; runners preinstall pwsh. Lets e2e/installer.bats pwsh
+# tests run locally instead of skipping.
+powershell = "7.6.5"
+# Keep in sync with the zizmor-action `version:` input in
+# .github/workflows/test.yml so local bin/ci runs the same release CI does.
+zizmor = "1.29.0"