diff --git a/.github/actions/build-collector-layer/action.yml b/.github/actions/build-collector-layer/action.yml
index 2c82b5ffbb..8e79be8f9e 100644
--- a/.github/actions/build-collector-layer/action.yml
+++ b/.github/actions/build-collector-layer/action.yml
@@ -24,7 +24,9 @@ runs:
 
     - name: Build collector layer
       shell: bash
-      run: make -C collector package GOARCH=${{ inputs.architecture }}
+      run: make -C collector package GOARCH="${INPUTS_ARCHITECTURE}"
+      env:
+        INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
 
     - name: Save collector version
       if: ${{ inputs.architecture == 'amd64' }}
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c7bd71a1d1..a9d27bc4a8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,6 +14,8 @@ updates:
       - "/go/sample-apps/function"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-collector:
         patterns:
@@ -27,6 +29,8 @@ updates:
       - "/java"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-java:
         patterns:
@@ -42,6 +46,8 @@ updates:
       - "/nodejs/sample-apps/aws-sdk"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-nodejs:
         patterns:
@@ -58,6 +64,8 @@ updates:
       - "/python/src/otel/tests"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-python:
         patterns:
@@ -72,6 +80,8 @@ updates:
       - "/ruby/sample-apps/function"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       opentelemetry-deps-ruby:
         patterns:
diff --git a/.github/workflows/check-links.yaml b/.github/workflows/check-links.yaml
index 24ab331807..c4a1c38f8f 100644
--- a/.github/workflows/check-links.yaml
+++ b/.github/workflows/check-links.yaml
@@ -12,7 +12,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref_name }}
   cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   changedfiles:
@@ -27,6 +28,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Get changed files
         id: changes
         run: |
@@ -46,6 +48,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Link Checker
         id: lychee
diff --git a/.github/workflows/ci-collector.yml b/.github/workflows/ci-collector.yml
index 52fb2ab7ab..4e3ad31bf1 100644
--- a/.github/workflows/ci-collector.yml
+++ b/.github/workflows/ci-collector.yml
@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: collector/go.mod
@@ -45,6 +47,8 @@ jobs:
         architecture: [ amd64, arm64 ]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: collector/go.mod
@@ -66,7 +70,7 @@ jobs:
       - name: Confirm architecture of built collector
         working-directory: collector/build/extensions
         run: |
-          grep ${{ env.LAMBDA_LAYER_ARCHITECTURE }} <<< "$(file collector)"
+          grep "${LAMBDA_LAYER_ARCHITECTURE}" <<< "$(file collector)"
       - name: Output artifact size to job summary
         working-directory: collector/build
         run: |
diff --git a/.github/workflows/ci-java.yml b/.github/workflows/ci-java.yml
index 3f26317b3c..6c3d87b70c 100644
--- a/.github/workflows/ci-java.yml
+++ b/.github/workflows/ci-java.yml
@@ -24,6 +24,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
diff --git a/.github/workflows/ci-nodejs.yml b/.github/workflows/ci-nodejs.yml
index 6b98898049..2f7b834f3b 100644
--- a/.github/workflows/ci-nodejs.yml
+++ b/.github/workflows/ci-nodejs.yml
@@ -22,6 +22,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: 'nodejs/.nvmrc'
diff --git a/.github/workflows/ci-python.yml b/.github/workflows/ci-python.yml
index fd9c844b24..875994341a 100644
--- a/.github/workflows/ci-python.yml
+++ b/.github/workflows/ci-python.yml
@@ -36,6 +36,8 @@ jobs:
     steps:
       - name: Checkout this repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Python for OTel Python SDK
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
diff --git a/.github/workflows/ci-shellcheck.yml b/.github/workflows/ci-shellcheck.yml
index 157b759bfb..9798446585 100644
--- a/.github/workflows/ci-shellcheck.yml
+++ b/.github/workflows/ci-shellcheck.yml
@@ -10,6 +10,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install shell check
         run: sudo apt update && sudo apt install --assume-yes shellcheck
diff --git a/.github/workflows/ci-terraform.yml b/.github/workflows/ci-terraform.yml
index af6c849e83..38e8be3e3c 100644
--- a/.github/workflows/ci-terraform.yml
+++ b/.github/workflows/ci-terraform.yml
@@ -22,5 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
       - run: terraform fmt -check -recursive
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ecc2f201dc..b11b0dc0eb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -65,6 +65,8 @@ jobs:
     steps:
     - name: Checkout repository
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 77f1dbb3c2..8c1cdb0542 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -13,6 +13,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
         with:
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index cbf07b549e..b33cecb7ff 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -26,6 +26,9 @@ on:
         required: false
         default: false
         type: boolean
+    secrets:
+      INTEGRATION_TEST_ROLE_ARN:
+        required: true
 
 permissions:
   contents: read
@@ -39,12 +42,14 @@ jobs:
       - id: prepare-languages
         name: Prepare Languages
         run: |
-          if [ "${{ inputs.language }}" = "all" ]; then
+          if [ "${INPUTS_LANGUAGE}" = "all" ]; then
             languages='["nodejs", "python", "ruby", "javaagent", "javawrapper"]'
           else
-            languages='["${{ inputs.language }}"]'
+            languages="[\"${INPUTS_LANGUAGE}\"]"
           fi
           echo "languages=${languages}" >> "$GITHUB_OUTPUT"
+        env:
+          INPUTS_LANGUAGE: ${{ inputs.language }}
 
   build-collector:
     runs-on: ubuntu-latest
@@ -54,6 +59,8 @@ jobs:
         architecture: [amd64, arm64]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/build-collector-layer
         id: build
         with:
@@ -73,6 +80,8 @@ jobs:
         language: ${{ fromJson(needs.prepare-languages.outputs.languages) }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/build-layer
         id: build
         with:
@@ -99,6 +108,8 @@ jobs:
       id-token: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
diff --git a/.github/workflows/layer-publish.yml b/.github/workflows/layer-publish.yml
index e1dbbe4a15..0473332bbb 100644
--- a/.github/workflows/layer-publish.yml
+++ b/.github/workflows/layer-publish.yml
@@ -40,6 +40,11 @@ on:
         description: '(optional) Layer version to be used in the layer name. If no input is given, its value is tried to be extracted from the `GITHUB_REF_NAME` variable'
         required: false
         type: string
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN:
+        required: false
+      PROD_LAMBDA_ROLE_ARN:
+        required: false
 
 permissions:
   contents: read
@@ -55,27 +60,27 @@ jobs:
       - name: Construct Layer Name
         shell: bash
         run: |
-          LAYER_NAME=${{ inputs.layer-name }}
+          LAYER_NAME="${INPUTS_LAYER_NAME}"
           
-          if [[ -n "${{ inputs.architecture }}" ]]; then
-            LAYER_NAME=$LAYER_NAME-${{ inputs.architecture }}
-            ARCH=$(echo "${{ inputs.architecture }}" | sed -r 's/amd64/x86_64/g')
+          if [[ -n "${INPUTS_ARCHITECTURE}" ]]; then
+            LAYER_NAME="${LAYER_NAME}-${INPUTS_ARCHITECTURE}"
+            ARCH=$(echo "${INPUTS_ARCHITECTURE}" | sed -r 's/amd64/x86_64/g')
           else
             ARCH="x86_64 arm64"
           fi
           echo "ARCH=$ARCH" >> $GITHUB_ENV
           
-          if [[ -n "${{ inputs.runtimes }}" ]]; then
-            COMPATIBLE_RUNTIMES="--compatible-runtimes ${{ inputs.runtimes }}"
+          if [[ -n "${INPUTS_RUNTIMES}" ]]; then
+            COMPATIBLE_RUNTIMES="--compatible-runtimes ${INPUTS_RUNTIMES}"
           fi
           echo "COMPATIBLE_RUNTIMES=$COMPATIBLE_RUNTIMES" >> $GITHUB_ENV
           
-          if [[ "${{ inputs.release-group }}" != "prod" ]]; then
-            LAYER_NAME=$LAYER_NAME-${{ inputs.release-group }}
+          if [[ "${INPUTS_RELEASE_GROUP}" != "prod" ]]; then
+            LAYER_NAME="${LAYER_NAME}-${INPUTS_RELEASE_GROUP}"
           fi
           
-          if [[ -n "${{ inputs.layer-version }}" ]]; then
-            LAYER_VERSION="${{ inputs.layer-version }}"
+          if [[ -n "${INPUTS_LAYER_VERSION}" ]]; then
+            LAYER_VERSION="${INPUTS_LAYER_VERSION}"
           else
             LAYER_VERSION=$(echo "$GITHUB_REF_NAME" | sed -r 's/.*\/[^0-9\.]*//g')
           fi
@@ -88,6 +93,12 @@ jobs:
           
           echo GITHUB_ENV:
           cat $GITHUB_ENV
+        env:
+          INPUTS_LAYER_NAME: ${{ inputs.layer-name }}
+          INPUTS_ARCHITECTURE: ${{ inputs.architecture }}
+          INPUTS_RUNTIMES: ${{ inputs.runtimes }}
+          INPUTS_RELEASE_GROUP: ${{ inputs.release-group }}
+          INPUTS_LAYER_VERSION: ${{ inputs.layer-version }}
 
       - name: Download built layer
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -109,11 +120,14 @@ jobs:
               --license-info "Apache 2.0" \
               --compatible-architectures $ARCH \
               $COMPATIBLE_RUNTIMES \
-              --zip-file fileb://${{ inputs.artifact-name }} \
+              --zip-file "fileb://${INPUTS_ARTIFACT_NAME}" \
               --query 'LayerVersionArn' \
               --output text
           )
-          echo "::notice ::$LAYER_ARN component-version=${{ inputs.component-version }}"
+          echo "::notice ::$LAYER_ARN component-version=${INPUTS_COMPONENT_VERSION}"
+        env:
+          INPUTS_ARTIFACT_NAME: ${{ inputs.artifact-name }}
+          INPUTS_COMPONENT_VERSION: ${{ inputs.component-version }}
         # echo "* $LAYER_ARN" >> $GITHUB_STEP_SUMMARY
 
       - name: Make Layer Public
diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
index 4111e8b5c9..3edf911e70 100644
--- a/.github/workflows/pr-checks.yaml
+++ b/.github/workflows/pr-checks.yaml
@@ -3,6 +3,7 @@ name: Check PR
 on:
   workflow_dispatch:
   pull_request_target:
+    # zizmor: ignore[dangerous-triggers] Pinned actions run only trusted base-branch code; no pull request head code is loaded.
     types: [opened, synchronize, reopened, ready_for_review]
 
 permissions:
@@ -17,6 +18,8 @@ jobs:
       pull-requests: write # required for adding labels to pr
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/publish-layer-collector.yml b/.github/workflows/publish-layer-collector.yml
index e59bff9fe0..eec1c612da 100644
--- a/.github/workflows/publish-layer-collector.yml
+++ b/.github/workflows/publish-layer-collector.yml
@@ -79,12 +79,14 @@ jobs:
         name: Prepare Build Jobs
         run: |
           architectures=''
-          if [ ${{ github.event.inputs.architecture }} == 'all' ]; then
+          if [ "${GITHUB_EVENT_INPUTS_ARCHITECTURE}" = 'all' ]; then
             architectures='["amd64", "arm64"]'
           else
-            architectures='["${{ github.event.inputs.architecture }}"]'
+            architectures="[\"${GITHUB_EVENT_INPUTS_ARCHITECTURE}\"]"
           fi
-          echo "build_jobs={"architecture": ${architectures}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT
+          printf 'build_jobs={"architecture":%s}\n' "$architectures" >> "$GITHUB_OUTPUT"
+        env:
+          GITHUB_EVENT_INPUTS_ARCHITECTURE: ${{ github.event.inputs.architecture }}
   build-layer:
     needs: prepare-build-jobs
     runs-on: ubuntu-latest
@@ -93,20 +95,25 @@ jobs:
     steps:
       - name: Checkout Repo
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Setup Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: collector/go.mod
       - name: Build Collector
         run: |
-          if [[ -n "${{ inputs.build-tags }}" ]]; then
-            BUILDTAGS="${{ inputs.build-tags }}"
+          if [[ -n "${INPUTS_BUILD_TAGS}" ]]; then
+            BUILDTAGS="${INPUTS_BUILD_TAGS}"
             if [[ "$BUILDTAGS" != "lambdacomponents.custom"* ]]; then
               BUILDTAGS="lambdacomponents.custom,$BUILDTAGS"
             fi
           fi
           echo "Build tags: $BUILDTAGS"
-          make -C collector package GOARCH=${{ matrix.architecture }} BUILDTAGS=$BUILDTAGS
+          make -C collector package GOARCH="${MATRIX_ARCHITECTURE}" BUILDTAGS="$BUILDTAGS"
+        env:
+          INPUTS_BUILD_TAGS: ${{ inputs.build-tags }}
+          MATRIX_ARCHITECTURE: ${{ matrix.architecture }}
       - name: Upload Collector Artifact
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
@@ -122,18 +129,21 @@ jobs:
         name: Prepare Release Jobs
         run: |
           architectures=''
-          if [ ${{ github.event.inputs.architecture }} == 'all' ]; then
+          if [ "${GITHUB_EVENT_INPUTS_ARCHITECTURE}" = 'all' ]; then
             architectures='["amd64", "arm64"]'
           else
-            architectures='["${{ github.event.inputs.architecture }}"]'
+            architectures="[\"${GITHUB_EVENT_INPUTS_ARCHITECTURE}\"]"
           fi
           aws_regions=''
-          if [ ${{ github.event.inputs.aws-region }} == 'all' ]; then
+          if [ "${GITHUB_EVENT_INPUTS_AWS_REGION}" = 'all' ]; then
             aws_regions='["af-south-1", "ap-east-1", "ap-east-2", "ap-northeast-1", "ap-northeast-2", "ap-northeast-3", "ap-south-1", "ap-south-2", "ap-southeast-1", "ap-southeast-2", "ap-southeast-3", "ap-southeast-4", "ap-southeast-5", "ap-southeast-6", "ap-southeast-7", "ca-central-1", "ca-west-1", "eu-central-1", "eu-central-2", "eu-north-1", "eu-south-1", "eu-south-2", "eu-west-1", "eu-west-2", "eu-west-3", "il-central-1", "me-central-1", "me-south-1", "mx-central-1", "sa-east-1", "us-east-1", "us-east-2", "us-west-1", "us-west-2"]'
           else
-            aws_regions='["${{ github.event.inputs.aws-region }}"]'
+            aws_regions="[\"${GITHUB_EVENT_INPUTS_AWS_REGION}\"]"
           fi
-          echo "release_jobs={"architecture": ${architectures}, "aws_region": ${aws_regions}}" | tr -d '[:space:]' >> $GITHUB_OUTPUT
+          printf 'release_jobs={"architecture":%s,"aws_region":%s}\n' "$architectures" "$aws_regions" >> "$GITHUB_OUTPUT"
+        env:
+          GITHUB_EVENT_INPUTS_ARCHITECTURE: ${{ github.event.inputs.architecture }}
+          GITHUB_EVENT_INPUTS_AWS_REGION: ${{ github.event.inputs.aws-region }}
   release-layer:
     permissions: # required by the reusable workflow
       contents: read
@@ -152,4 +162,6 @@ jobs:
       role-arn: ${{ github.event.inputs.role-arn }}
       component-version: 'NA'
       layer-version: ${{ github.event.inputs.layer-version }}
-    secrets: inherit
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN: ${{ secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN }}
+      PROD_LAMBDA_ROLE_ARN: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
diff --git a/.github/workflows/release-layer-collector.yml b/.github/workflows/release-layer-collector.yml
index a57c0dbdd2..306baa072f 100644
--- a/.github/workflows/release-layer-collector.yml
+++ b/.github/workflows/release-layer-collector.yml
@@ -16,8 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Create Release
-        run: gh release create ${{ github.ref_name }} --draft --title ${{ github.ref_name }}
+        run: gh release create "$GITHUB_REF_NAME" --draft --title "$GITHUB_REF_NAME"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
@@ -34,6 +36,8 @@ jobs:
       component-version: ${{ steps.build.outputs.component-version }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - uses: ./.github/actions/build-collector-layer
         id: build
         with:
@@ -43,9 +47,10 @@ jobs:
           name: opentelemetry-collector-layer-${{ matrix.architecture }}.zip
           path: ${{ steps.build.outputs.artifact-path }}
       - name: Add Binary to Release
-        run: gh release upload ${{ github.ref_name }} ${{ steps.build.outputs.artifact-path }}
+        run: gh release upload "$GITHUB_REF_NAME" "$STEPS_BUILD_OUTPUTS_ARTIFACT_PATH"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_BUILD_OUTPUTS_ARTIFACT_PATH: ${{ steps.build.outputs.artifact-path }}
 
   publish-layer:
     permissions: # required by the reusable workflow
@@ -100,4 +105,6 @@ jobs:
       architecture: ${{ matrix.architecture }}
       release-group: prod
       aws_region: ${{ matrix.aws_region }}
-    secrets: inherit
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN: ${{ secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN }}
+      PROD_LAMBDA_ROLE_ARN: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
diff --git a/.github/workflows/release-layer-java.yml b/.github/workflows/release-layer-java.yml
index 22f33c0eb4..aef07c1979 100644
--- a/.github/workflows/release-layer-java.yml
+++ b/.github/workflows/release-layer-java.yml
@@ -16,8 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Create Release
-        run: gh release create ${{ github.ref_name }} --draft --title ${{ github.ref_name }}
+        run: gh release create "$GITHUB_REF_NAME" --draft --title "$GITHUB_REF_NAME"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
@@ -30,6 +32,8 @@ jobs:
       JAVAWRAPPER_VERSION: ${{ steps.build.outputs.javawrapper-version }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/build-java-layer
         id: build
@@ -54,9 +58,11 @@ jobs:
 
       - name: Add Binary to Release
         run: |
-          gh release upload ${{github.ref_name}} ${{ steps.build.outputs.javawrapper-artifact-path }} ${{ steps.build.outputs.javawrapper-targz-artifact-path }}
+          gh release upload "$GITHUB_REF_NAME" "$STEPS_BUILD_OUTPUTS_JAVAWRAPPER_ARTIFACT_PATH" "$STEPS_BUILD_OUTPUTS_JAVAWRAPPER_TARGZ_ARTIFACT_PATH"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_BUILD_OUTPUTS_JAVAWRAPPER_ARTIFACT_PATH: ${{ steps.build.outputs.javawrapper-artifact-path }}
+          STEPS_BUILD_OUTPUTS_JAVAWRAPPER_TARGZ_ARTIFACT_PATH: ${{ steps.build.outputs.javawrapper-targz-artifact-path }}
 
   integration-test:
     permissions:
@@ -70,7 +76,8 @@ jobs:
     with:
       language: ${{ matrix.flavor }}
       use-existing-layer-artifact: true
-    secrets: inherit
+    secrets:
+      INTEGRATION_TEST_ROLE_ARN: ${{ secrets.INTEGRATION_TEST_ROLE_ARN }}
 
   publish-javaagent-layer:
     permissions: # required by the reusable workflow
@@ -125,7 +132,9 @@ jobs:
       runtimes: java8.al2 java11 java17 java21
       release-group: prod
       aws_region: ${{ matrix.aws_region }}
-    secrets: inherit
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN: ${{ secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN }}
+      PROD_LAMBDA_ROLE_ARN: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
 
   publish-javawrapper-layer:
     permissions: # required by the reusable workflow
@@ -178,4 +187,6 @@ jobs:
       runtimes: java8.al2 java11 java17
       release-group: prod
       aws_region: ${{ matrix.aws_region }}
-    secrets: inherit
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN: ${{ secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN }}
+      PROD_LAMBDA_ROLE_ARN: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
diff --git a/.github/workflows/release-layer-nodejs.yml b/.github/workflows/release-layer-nodejs.yml
index 90f2de410a..e95efe4d36 100644
--- a/.github/workflows/release-layer-nodejs.yml
+++ b/.github/workflows/release-layer-nodejs.yml
@@ -16,8 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Create Release
-        run: gh release create ${{ github.ref_name }} --draft --title ${{ github.ref_name }}
+        run: gh release create "$GITHUB_REF_NAME" --draft --title "$GITHUB_REF_NAME"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
   build-layer:
@@ -29,6 +31,8 @@ jobs:
       component-version: ${{ steps.build.outputs.component-version }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/build-nodejs-layer
         id: build
@@ -40,9 +44,10 @@ jobs:
           path: ${{ steps.build.outputs.artifact-path }}
 
       - name: Add Binary to Release
-        run: gh release upload ${{ github.ref_name }} ${{ steps.build.outputs.artifact-path }}
+        run: gh release upload "$GITHUB_REF_NAME" "$STEPS_BUILD_OUTPUTS_ARTIFACT_PATH"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          STEPS_BUILD_OUTPUTS_ARTIFACT_PATH: ${{ steps.build.outputs.artifact-path }}
 
   integration-test:
     permissions:
@@ -53,7 +58,8 @@ jobs:
     with:
       language: nodejs
       use-existing-layer-artifact: true
-    secrets: inherit
+    secrets:
+      INTEGRATION_TEST_ROLE_ARN: ${{ secrets.INTEGRATION_TEST_ROLE_ARN }}
 
   publish-layer:
     permissions: # required by the reusable workflow
@@ -108,4 +114,6 @@ jobs:
       runtimes: nodejs20.x nodejs22.x nodejs24.x
       release-group: prod
       aws_region: ${{ matrix.aws_region }}
-    secrets: inherit
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN: ${{ secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN }}
+      PROD_LAMBDA_ROLE_ARN: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
diff --git a/.github/workflows/release-layer-python.yml b/.github/workflows/release-layer-python.yml
index 40308d1634..c3bd163041 100644
--- a/.github/workflows/release-layer-python.yml
+++ b/.github/workflows/release-layer-python.yml
@@ -16,6 +16,8 @@ jobs:
       component-version: ${{ steps.build.outputs.component-version }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/build-python-layer
         id: build
@@ -35,7 +37,8 @@ jobs:
     with:
       language: python
       use-existing-layer-artifact: true
-    secrets: inherit
+    secrets:
+      INTEGRATION_TEST_ROLE_ARN: ${{ secrets.INTEGRATION_TEST_ROLE_ARN }}
 
   create-release:
     permissions:
@@ -44,9 +47,11 @@ jobs:
     needs: [build-layer, integration-test]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Create Release
-        run: gh release create ${{ github.ref_name }} --draft --title ${{ github.ref_name }}
+        run: gh release create "$GITHUB_REF_NAME" --draft --title "$GITHUB_REF_NAME"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -55,7 +60,7 @@ jobs:
           name: opentelemetry-python-layer.zip
 
       - name: Add Binary to Release
-        run: gh release upload ${{ github.ref_name }} opentelemetry-python-layer.zip
+        run: gh release upload "$GITHUB_REF_NAME" opentelemetry-python-layer.zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -108,4 +113,6 @@ jobs:
       component-version: ${{ needs.build-layer.outputs.component-version }}
       release-group: prod
       aws_region: ${{ matrix.aws_region }}
-    secrets: inherit
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN: ${{ secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN }}
+      PROD_LAMBDA_ROLE_ARN: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
diff --git a/.github/workflows/release-layer-ruby.yml b/.github/workflows/release-layer-ruby.yml
index 017c14fc9c..6787f0e1a2 100644
--- a/.github/workflows/release-layer-ruby.yml
+++ b/.github/workflows/release-layer-ruby.yml
@@ -16,6 +16,8 @@ jobs:
       component-version: ${{ steps.build.outputs.component-version }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: ./.github/actions/build-ruby-layer
         id: build
@@ -35,7 +37,8 @@ jobs:
     with:
       language: ruby
       use-existing-layer-artifact: true
-    secrets: inherit
+    secrets:
+      INTEGRATION_TEST_ROLE_ARN: ${{ secrets.INTEGRATION_TEST_ROLE_ARN }}
 
   create-release:
     permissions:
@@ -44,9 +47,11 @@ jobs:
     needs: [build-layer, integration-test]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Create Release
-        run: gh release create ${{ github.ref_name }} --draft --title ${{ github.ref_name }}
+        run: gh release create "$GITHUB_REF_NAME" --draft --title "$GITHUB_REF_NAME"
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -55,7 +60,7 @@ jobs:
           name: opentelemetry-ruby-layer.zip
 
       - name: Add Binary to Release
-        run: gh release upload ${{ github.ref_name }} opentelemetry-ruby-layer.zip
+        run: gh release upload "$GITHUB_REF_NAME" opentelemetry-ruby-layer.zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -109,4 +114,6 @@ jobs:
       runtimes: ruby3.3 ruby3.4
       release-group: prod
       aws_region: ${{ matrix.aws_region }}
-    secrets: inherit
+    secrets:
+      OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN: ${{ secrets.OTEL_LAMBDA_LAYER_PUBLISH_ROLE_ARN }}
+      PROD_LAMBDA_ROLE_ARN: ${{ secrets.PROD_LAMBDA_ROLE_ARN }}
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 0000000000..5ebcb7c048
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,18 @@
+name: Zizmor
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    - cron: '16 22 * * 6' # weekly at 22:16 UTC on Saturday
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    permissions:
+      contents: read # for actions/checkout
+      security-events: write # for zizmor to upload SARIF results
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@d9b812f9924a121c6a8276ea2f9e6f5b622cdd4d # v0.10.0