diff --git a/.github/workflows/backup-daily.yml b/.github/workflows/backup-daily.yml
index f1824b30..be953bc0 100644
--- a/.github/workflows/backup-daily.yml
+++ b/.github/workflows/backup-daily.yml
@@ -5,8 +5,12 @@ on:
     schedule:
       - cron: 0 6 * * *
 
+# backup.yml only uses GITHUB_TOKEN (passed to called workflows
+# automatically); AWS access comes from the runner's instance profile.
+permissions:
+  contents: read
+
 jobs:
   s3-backup-daily:
     uses: narrative-io/common-github/.github/workflows/backup.yml@ad6b23573ee7a7573f6499818f61429cc5238e76 # 2026-07-16, post-hardening (sc-62809)
     # uses: ./.github/workflows/backup.yml
-    secrets: inherit
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..4f355c6c
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,26 @@
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: ["master"]
+  pull_request:
+    branches: ["**"]
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Run zizmor 🌈
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Required for upload-sarif (used by zizmor-action) to upload SARIF files.
+      contents: read         # Only needed for private repos. Needed to clone the repo.
+      actions: read          # Only needed for private repos. Needed for upload-sarif to read workflow run info.
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
diff --git a/library/src/plugins/vue-fontawesome/.github/workflows/ci.yml b/library/src/plugins/vue-fontawesome/.github/workflows/ci.yml
deleted file mode 100644
index c8e1a41e..00000000
--- a/library/src/plugins/vue-fontawesome/.github/workflows/ci.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-name: CI
-
-on: [push]
-
-jobs:
-  build:
-
-    runs-on: ubuntu-latest
-
-    strategy:
-      matrix:
-        node-version: [8.x, 10.x, 12.x]
-
-    steps:
-    - uses: actions/checkout@v1
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v1
-      with:
-        node-version: ${{ matrix.node-version }}
-    - name: install, build, and test
-      run: |
-        npm install
-        npm run build
-        npm run test
-      env:
-        CI: true
-    - name: dist
-      run: |
-        npm run dist