diff --git a/.github/poutine.yml b/.github/poutine.yml
new file mode 100644
index 00000000..98eda4fa
--- /dev/null
+++ b/.github/poutine.yml
@@ -0,0 +1,13 @@
+skip:
+  # All actions are pinned to a full commit SHA and were reviewed when added.
+  - rule: github_action_from_unverified_creator_used
+    purl:
+      - pkg:githubactions/astral-sh/setup-uv
+      - pkg:githubactions/dessant/lock-threads
+      - pkg:githubactions/peter-evans/create-pull-request
+      - pkg:githubactions/shivammathur/setup-php
+      - pkg:githubactions/softprops/action-gh-release
+      - pkg:githubactions/stefanzweifel/git-auto-commit-action
+      - pkg:githubactions/synacktiv/action-octoscan
+      - pkg:githubactions/wyrihaximus/github-action-get-previous-tag
+      - pkg:githubactions/wyrihaximus/github-action-next-semvers
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index e09ea704..0a8b1bad 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -10,8 +10,13 @@ on:
 
 permissions: {}
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   actionlint:
+    name: actionlint
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -20,12 +25,14 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Register actionlint problem matcher
+        run: echo "::add-matcher::.github/actionlint-matcher.json"
       - name: Check workflow files
-        run: |
-          echo "::add-matcher::.github/actionlint-matcher.json"
-          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
-          ./actionlint -color
-        shell: bash
+        uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 # 1.7.12
+        with:
+          args: -color
 
   octoscan:
     name: Octoscan
@@ -40,11 +47,16 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Run octoscan
         id: octoscan
         uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
         with:
           filter_triggers: ''
+          # octoscan treats any ref that is not purely letters and dashes as dynamic, so it flags
+          # the static branch names checked out in update.yml (PHP-8.x) and send-pr.yml (2.3.x).
+          ignore: "Use of 'actions/checkout' with a custom ref"
 
       - name: Upload SARIF file to GitHub
         uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
diff --git a/.github/workflows/lock-closed-issues.yml b/.github/workflows/lock-closed-issues.yml
index a05f583d..e0400af8 100644
--- a/.github/workflows/lock-closed-issues.yml
+++ b/.github/workflows/lock-closed-issues.yml
@@ -7,8 +7,13 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   lock:
+    name: "Lock closed issues"
     permissions:
       issues: write  # for dessant/lock-threads to lock issues
     runs-on: ubuntu-latest
diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index 0b1446a3..e25d4971 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -16,6 +16,10 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   phpstan:
     name: "PHPStan"
@@ -28,8 +32,10 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "8.3"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 42c58df1..a37ac54f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,7 +7,10 @@ on:
     tags:
       - '*'
 
-concurrency: release
+# Every tag needs its own release, so queue runs instead of cancelling them.
+concurrency:
+  group: release
+  cancel-in-progress: false
 
 permissions:
   contents: read
@@ -27,6 +30,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Create release"
         uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
diff --git a/.github/workflows/send-pr.yml b/.github/workflows/send-pr.yml
index 548077bd..94571f8f 100644
--- a/.github/workflows/send-pr.yml
+++ b/.github/workflows/send-pr.yml
@@ -9,6 +9,11 @@ on:
 permissions:
   contents: read
 
+# Every release needs its own pull request, so queue runs instead of cancelling them.
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
 jobs:
   send-pr:
     name: "Send pull request"
@@ -20,7 +25,7 @@ jobs:
           egress-policy: audit
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "8.3"
@@ -32,19 +37,25 @@ jobs:
           ref: 2.3.x
           path: phpstan-src
           token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
+          persist-credentials: false
 
       - name: "Install dependencies"
         working-directory: ./phpstan-src
         run: "composer install --no-interaction --no-progress --no-suggest"
 
-      - name: "Get old version"
+      - name: "Write pull request body"
         working-directory: ./phpstan-src
-        id: old-version
-        run: echo "version=$(composer info phpstan/php-8-stubs --format json | jq --raw-output '.versions[0]')" >> "$GITHUB_OUTPUT"
+        env:
+          NEW_VERSION: ${{ github.ref_name }}
+        run: |
+          old_version="$(composer info phpstan/php-8-stubs --format json | jq --raw-output '.versions[0]')"
+          echo "Update PHP 8 stubs to ${NEW_VERSION}: https://github.com/phpstan/php-8-stubs/compare/${old_version}...${NEW_VERSION}" > "${RUNNER_TEMP}/pr-body.md"
 
       - name: "Change composer.json"
         working-directory: ./phpstan-src
-        run: "composer require phpstan/php-8-stubs:${{ github.ref_name }}"
+        env:
+          NEW_VERSION: ${{ github.ref_name }}
+        run: composer require "phpstan/php-8-stubs:${NEW_VERSION}"
 
       - name: "Create Pull Request"
         id: create-pr
@@ -55,6 +66,6 @@ jobs:
           branch-suffix: random
           delete-branch: true
           title: "Update PHP 8 stubs to ${{ github.ref_name }}"
-          body: "Update PHP 8 stubs to ${{ github.ref_name }}: https://github.com/phpstan/php-8-stubs/compare/${{ steps.old-version.outputs.version }}...${{ github.ref_name }}"
+          body-path: ${{ runner.temp }}/pr-body.md
           committer: "phpstan-bot <ondrej+phpstanbot@mirtes.cz>"
           commit-message: "Update PHP 8 stubs"
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 35452ef0..635c573d 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -11,6 +11,14 @@ on:
     # * is a special character in YAML so you have to quote this string
       - cron: '0 0 * * *'
 
+permissions:
+  contents: read
+
+# Cancel superseded pull request runs; queue runs on main so a commit and tag are never interrupted.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
 jobs:
   update:
     name: "Update stubs"
@@ -21,18 +29,20 @@ jobs:
         with:
           egress-policy: audit
 
-      - name: "Checkout to commit"
+      # git-auto-commit-action pushes with the credentials persisted by this checkout.
+      - name: "Checkout to commit" # zizmor: ignore[artipacked]
         if: github.event_name != 'pull_request'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          ref: ${{ github.head_ref }}
           fetch-depth: '0'
           token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
       - name: "Checkout to only read"
         if: github.event_name == 'pull_request'
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # v2.40.0
+        uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
           coverage: "none"
           php-version: "8.3"
@@ -44,6 +54,7 @@ jobs:
         with:
           repository: "php/php-src"
           path: "php-src"
+          persist-credentials: false
           ref: "PHP-8.0"
       - name: "Extract stubs"
         run: "./extractor/extract.php"
@@ -56,6 +67,7 @@ jobs:
         with:
           repository: "php/php-src"
           path: "php-src"
+          persist-credentials: false
           ref: "PHP-8.1"
       - name: "Update stubs"
         run: "./extractor/extract.php --update -- 8.0 8.1"
@@ -69,6 +81,7 @@ jobs:
         with:
           repository: "php/php-src"
           path: "php-src"
+          persist-credentials: false
           ref: "PHP-8.2"
       - name: "Update stubs"
         run: "./extractor/extract.php --update -- 8.1 8.2"
@@ -82,6 +95,7 @@ jobs:
         with:
           repository: "php/php-src"
           path: "php-src"
+          persist-credentials: false
           ref: "PHP-8.3"
       - name: "Update stubs"
         run: "./extractor/extract.php --update -- 8.2 8.3"
@@ -95,6 +109,7 @@ jobs:
         with:
           repository: "php/php-src"
           path: "php-src"
+          persist-credentials: false
           ref: "PHP-8.4"
       - name: "Update stubs"
         run: "./extractor/extract.php --update -- 8.3 8.4"
@@ -108,6 +123,7 @@ jobs:
         with:
           repository: "php/php-src"
           path: "php-src"
+          persist-credentials: false
           ref: "PHP-8.5"
       - name: "Update stubs"
         run: "./extractor/extract.php --update -- 8.4 8.5"
@@ -121,6 +137,7 @@ jobs:
         with:
           repository: "php/php-src"
           path: "php-src"
+          persist-credentials: false
           ref: "PHP-8.6"
       - name: "Update stubs"
         run: "./extractor/extract.php --update -- 8.5 8.6"
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 00000000..f7f930bc
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,15 @@
+rules:
+  secrets-outside-env:
+    # PHPSTAN_BOT_TOKEN is a repository secret, used so that pushes, tags, releases and
+    # pull requests made by these workflows trigger further workflows.
+    ignore:
+      - release.yml
+      - send-pr.yml
+      - update.yml
+  superfluous-actions:
+    # These actions do more than a single CLI call (tagging, release creation, branch
+    # handling), and replacing them would change how releases are produced.
+    ignore:
+      - release.yml
+      - send-pr.yml
+      - update.yml