diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
new file mode 100644
index 000000000..69aef6465
--- /dev/null
+++ b/.github/workflows/zizmor.yaml
@@ -0,0 +1,12 @@
+name: zizmor
+
+on:
+  pull_request:
+  push:
+
+jobs:
+  zizmor:
+    permissions:
+      security-events: write
+
+    uses: zizmorcore/workflow/.github/workflows/reusable-zizmor.yml@465600191822382e76d26abf77772f21262ecdb6  # main
diff --git a/changelog.d/20260616_152921_sirosen_add_zizmor.rst b/changelog.d/20260616_152921_sirosen_add_zizmor.rst
new file mode 100644
index 000000000..99fe9796b
--- /dev/null
+++ b/changelog.d/20260616_152921_sirosen_add_zizmor.rst
@@ -0,0 +1,5 @@
+Security
+--------
+
+- GitHub Actions security is now checked with `zizmor <https://zizmor.sh>`_
+  (:pr:`NUMBER`)