diff --git a/.github/actions/ci-setup/action.yml b/.github/actions/ci-setup/action.yml
index 1e2c37c4..548d70eb 100644
--- a/.github/actions/ci-setup/action.yml
+++ b/.github/actions/ci-setup/action.yml
@@ -10,6 +10,11 @@ inputs:
 runs:
   using: composite
   steps:
+    - name: Check out repo
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      with:
+        persist-credentials: false
+
     - name: Set up pnpm
       uses: pnpm/action-setup@8912a9102ac27614460f54aedde9e1e7f9aec20d # v6.0.5
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 67ea2549..92d7de31 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
           persona: pedantic
           annotations: true
@@ -43,12 +43,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
 
       - name: Test
         run: pnpm test
@@ -58,12 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
 
       - name: Typecheck
         run: pnpm typecheck
@@ -73,12 +63,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
 
       - name: Format
         run: pnpm format
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 66df3ccf..04619aac 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -24,12 +24,7 @@ jobs:
     permissions:
       contents: read # to check out repo (actions/checkout)
     steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
@@ -50,19 +45,14 @@ jobs:
     permissions:
       contents: read # to check out repo (actions/checkout)
     steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
       - name: Build
         run: pnpm build
 
-      - uses: ./.github/actions/setup-bot-auth
+      - uses: $/.github/actions/setup-bot-auth
         id: bot-auth
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
@@ -87,19 +77,14 @@ jobs:
     permissions:
       contents: write # to create release and have it authored by github-actions (changesets/action)
     steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
       - name: Build
         run: pnpm build
 
-      - uses: ./.github/actions/setup-bot-auth
+      - uses: $/.github/actions/setup-bot-auth
         id: bot-auth
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 87d3b31c..1e6fcb67 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -122,12 +122,7 @@ jobs:
       pull-requests: write # to comment on the pull request with the release result (changesets/action)
 
     steps:
-      - name: Check out repo
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-        with:
-          persist-credentials: false
-
-      - uses: ./.github/actions/ci-setup
+      - uses: $/.github/actions/ci-setup
         with:
           skip-cache: true # avoid cache poisoning attacks
 
@@ -166,7 +161,7 @@ jobs:
       - name: Build
         run: pnpm build
 
-      - uses: ./.github/actions/setup-bot-auth
+      - uses: $/.github/actions/setup-bot-auth
         id: bot-auth
         with:
           client-id: ${{ vars.APP_CLIENT_ID }}