diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5ace4600..e8eb01ec 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,4 +3,10 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "weekly"
+      interval: "monthly"
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci-additional.yml b/.github/workflows/ci-additional.yml
index 810154a0..ef6e3f90 100644
--- a/.github/workflows/ci-additional.yml
+++ b/.github/workflows/ci-additional.yml
@@ -12,6 +12,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   doctests:
     name: Doctests
@@ -23,13 +25,14 @@ jobs:
 
     steps:
       - name: checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # need to fetch all tags to get a correct version
           fetch-depth: 0 # fetch all branches and tags
+          persist-credentials: false
 
       - name: setup environment
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # 0.9.6
+        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
         with:
           environments: "ci-py313"
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 19d92e0c..a2a89336 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   detect-skip-ci-trigger:
     name: "Detect CI Trigger: [skip-ci]"
@@ -20,10 +22,11 @@ jobs:
     outputs:
       triggered: ${{ steps.detect-trigger.outputs.trigger-found }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 2
-      - uses: xarray-contrib/ci-trigger@v1
+          persist-credentials: false
+      - uses: xarray-contrib/ci-trigger@10cd2bfec3484946a4058a421ddf9cfad101e715 # v1.2.1
         id: detect-trigger
         with:
           keyword: "[skip-ci]"
@@ -65,28 +68,31 @@ jobs:
       run:
         shell: bash -l {0}
 
-    env:
-      FORCE_COLOR: 3
-
     strategy:
       fail-fast: false
       matrix:
         env: ["ci-py311", "ci-py313", "ci-py314"]
         os: ["ubuntu-latest", "macos-latest", "windows-latest"]
 
+    env:
+      FORCE_COLOR: 3
+      ENV: ${{ matrix.env }}
+      RUNNER_OS: ${{ matrix.os }}
+
     steps:
       - name: checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # need to fetch all tags to get a correct version
           fetch-depth: 0 # fetch all branches and tags
+          persist-credentials: false
 
       - uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
         with:
           cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
 
       - name: setup environment
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # 0.9.6
+        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
         with:
           pixi-version: "${{ needs.cache-pixi-lock.outputs.pixi-version }}"
           frozen: true
@@ -95,23 +101,22 @@ jobs:
 
       - name: investigate env variables
         run: |
-          echo PYTHON_VERSION=$(pixi run -e ${{ matrix.env }} python -c 'import sys; print(".".join(map(str, sys.version_info[:2])))') >> $GITHUB_ENV
-          echo RUNNER_OS="${{ matrix.os }}"
+          echo PYTHON_VERSION=$(pixi run -e $ENV python -c 'import sys; print(".".join(map(str, sys.version_info[:2])))') >> $GITHUB_ENV
 
       - name: import pint-xarray
         run: |
-          pixi run -e ${{ matrix.env }} python -c 'import pint_xarray'
+          pixi run -e $ENV python -c 'import pint_xarray'
 
       - name: run tests
         if: success()
         id: status
         run: |
-          pixi run -e ${{ matrix.env }} tests --cov-report=xml
+          pixi run -e $ENV tests --cov-report=xml
 
       - name: Upload code coverage to Codecov
-        uses: codecov/codecov-action@v7.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
-          token: "${{ secrets.CODECOV_TOKEN }}"
+          token: "${{ secrets.CODECOV_TOKEN }}" # zizmor: ignore[secrets-outside-env] codecov token
           files: ./coverage.xml
           flags: unittests
           env_vars: RUNNER_OS,PYTHON_VERSION
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index e3c25ef5..c9ea2bee 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -14,6 +14,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   detect-test-upstream-trigger:
     name: "Detect CI Trigger: [test-upstream]"
@@ -24,10 +26,11 @@ jobs:
     outputs:
       triggered: ${{ steps.detect-trigger.outputs.trigger-found }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 2
-      - uses: xarray-contrib/ci-trigger@v1.2
+          persist-credentials: false
+      - uses: xarray-contrib/ci-trigger@10cd2bfec3484946a4058a421ddf9cfad101e715 # v1.2.1
         id: detect-trigger
         with:
           keyword: "[test-upstream]"
@@ -57,13 +60,14 @@ jobs:
 
     steps:
       - name: checkout the repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           # need to fetch all tags to get a correct version
           fetch-depth: 0 # fetch all branches and tags
+          persist-credentials: false
 
       - name: setup environment
-        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # 0.9.6
+        uses: prefix-dev/setup-pixi@5185adfbffb4bd703da3010310260805d89ebb11 # v0.9.6
         with:
           environments: "nightly"
           locked: false
@@ -80,11 +84,33 @@ jobs:
         run: |
           pixi run -e nightly tests -rf --report-log=pytest-log.jsonl
 
+      - name: upload the log file
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: log file
+          path: pytest-log.jsonl
+
+  create-issue:
+    name: Report failures
+    runs-on: ubuntu-latest
+    needs: upstream-dev
+
+    if: |
+      always()
+      && needs.upstream-dev.result == 'failure'
+      && github.repository == 'xarray-contrib/pint-xarray'
+      && github.event_name == 'schedule'
+
+    permissions:
+      issues: write # open issues if the tests failed
+
+    steps:
+      - name: download log file
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        with:
+          name: log file
+
       - name: report failures
-        if: |
-          failure()
-          && steps.status.outcome == 'failure'
-          && github.event_name == 'schedule'
-        uses: scientific-python/issue-from-pytest-log@v1
+        uses: scientific-python/issue-from-pytest-log@8e905db353437cda1d6a773de245343fbfc940dd # v1.5.0
         with:
           log-path: pytest-log.jsonl
diff --git a/.github/workflows/pypi.yaml b/.github/workflows/pypi.yaml
index cd72a015..8eb06fa4 100644
--- a/.github/workflows/pypi.yaml
+++ b/.github/workflows/pypi.yaml
@@ -4,17 +4,34 @@ on:
   release:
     types:
       - published
+  pull_request:
+    branches:
+      - main
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions: {}
 
 jobs:
   build-artifacts:
+    name: Build packages
     runs-on: ubuntu-latest
-    if: github.repository == 'xarray-contrib/pint-xarray'
+    if: |
+      github.repository == 'xarray-contrib/pint-xarray'
+      && (
+        github.event_name == 'release'
+        || contains(github.event.pull_request.labels.*.name, 'release')
+      )
+
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         name: Install Python
         with:
           python-version: "3.x"
@@ -40,12 +57,13 @@ jobs:
           else
             echo "✅ Looks good"
           fi
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: releases
           path: dist
 
   upload-to-pypi:
+    name: Upload to PyPI
     needs: build-artifacts
     if: github.event_name == 'release'
     runs-on: ubuntu-latest
@@ -54,14 +72,14 @@ jobs:
       name: pypi
       url: https://pypi.org/p/pint-xarray
     permissions:
-      id-token: write
+      id-token: write # upload packages to pypi
 
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 # v8.0.0
         with:
           name: releases
           path: dist
       - name: Publish package to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           verbose: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 2276cd92..fff74ca0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -28,6 +28,10 @@ repos:
     rev: 26.5.1
     hooks:
       - id: black-jupyter
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.23.1
+    hooks:
+      - id: zizmor
   - repo: https://github.com/keewis/blackdoc
     rev: v0.4.6
     hooks: