diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 488b2059..ca73edbd 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -11,6 +11,8 @@ on:
       - main
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
 
   deploy:
@@ -21,6 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
       - name: Set up Python
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
diff --git a/.github/workflows/make_bundle_conda.yml b/.github/workflows/make_bundle_conda.yml
index ad420fc1..0393e990 100644
--- a/.github/workflows/make_bundle_conda.yml
+++ b/.github/workflows/make_bundle_conda.yml
@@ -52,6 +52,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   packages:
     name: Create packages
@@ -67,6 +69,7 @@ jobs:
       - name: Checkout packaging code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           repository: napari/packaging
           path: napari-packaging
@@ -78,6 +81,7 @@ jobs:
       - name: Checkout napari source
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           repository: napari/napari
           path: napari-source
@@ -87,6 +91,7 @@ jobs:
       - name: Checkout conda-forge feedstock
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           repository: conda-forge/napari-feedstock
           path: napari-feedstock
@@ -217,6 +222,8 @@ jobs:
         # Python versions the installers will bundle. The general
         # principle is to follow the SPEC-0 recommendation:
         # https://scientific-python.org/specs/spec-0000/
+        env:
+          installer-platforms: ${{ inputs.installer_platforms || 'linux-64,win-64,osx-64,osx-arm64' }}
         run: |
           import os
           import json
@@ -243,7 +250,7 @@ jobs:
               "target-platform": "win-64",
             },
           ]
-          platforms_str = "${{ inputs.installer_platforms || 'linux-64,win-64,osx-64,osx-arm64' }}"
+          platforms_str = os.environ["installer-platforms"]
           platforms = {p.strip() for p in platforms_str.split(",")}
 
           matrix = {"include": []}
@@ -278,6 +285,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           repository: napari/packaging
           path: napari-packaging
@@ -285,6 +293,7 @@ jobs:
       - name: Checkout napari/napari
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           fetch-depth: 0
           repository: napari/napari
           path: napari-source
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 9ac86378..da9feedf 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -21,6 +21,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test:
     name: ${{ matrix.platform }} py${{ matrix.python-version }}
@@ -32,6 +34,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
diff --git a/.github/workflows/tests_ui.yml b/.github/workflows/tests_ui.yml
index e3692b3b..5cfcccf7 100644
--- a/.github/workflows/tests_ui.yml
+++ b/.github/workflows/tests_ui.yml
@@ -20,6 +20,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test:
     name: ${{ matrix.platform }} py${{ matrix.python-version }}
@@ -32,6 +34,8 @@ jobs:
         DISPLAY: ':99.0'
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
diff --git a/.github/workflows/typing.yml b/.github/workflows/typing.yml
index 59f258bf..98fd2efd 100644
--- a/.github/workflows/typing.yml
+++ b/.github/workflows/typing.yml
@@ -22,6 +22,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   test:
     name: ${{ matrix.platform }} py${{ matrix.python-version }}
@@ -33,6 +35,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
         uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
diff --git a/.github/workflows/upstream_checks.yml b/.github/workflows/upstream_checks.yml
index 89597d0c..69bfb404 100644
--- a/.github/workflows/upstream_checks.yml
+++ b/.github/workflows/upstream_checks.yml
@@ -26,6 +26,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: napari/napari
           fetch-depth: 0
 
@@ -44,6 +45,7 @@ jobs:
         if: env.PYPROJECT_TOML_CHANGES && github.event_name == 'schedule'
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
+          persist-credentials: false
           repository: napari/packaging
 
       - name: Create issue
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 37e2f25a..afef56bf 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,3 +18,8 @@ repos:
       # compatible replacement for black
       - id: ruff-format
         exclude: ^constructor-manager-ui/src/constructor_manager_ui/style/images.py
+  - repo: https://github.com/zizmorcore/zizmor-pre-commit
+    rev: v1.12.1
+    hooks:
+    - id: zizmor
+      args: [--min-severity=medium, --quiet, --no-progress]
diff --git a/conda-recipe/recipe.yaml b/conda-recipe/recipe.yaml
index ac83e111..dbe7c5c6 100644
--- a/conda-recipe/recipe.yaml
+++ b/conda-recipe/recipe.yaml
@@ -91,7 +91,7 @@ outputs:
           - if: unix
             then:
               - napari --version
-              - napari --version | grep "$(echo ${PKG_VERSION} | sed -re 's/(\.[0-9]+)\.dev/\1dev/')"
+              - napari --version | sed -re 's/(.*\.[0-9]+)\.dev(.*)/\1dev\2/' | grep "${PKG_VERSION}"
             else:
               - napari --version
           # If the following line is uncommented, also uncomment requirements.