diff --git a/.github/actions/downgrade-code/action.yml b/.github/actions/downgrade-code/action.yml
index 158f6fd1936..978a5f040f2 100644
--- a/.github/actions/downgrade-code/action.yml
+++ b/.github/actions/downgrade-code/action.yml
@@ -18,9 +18,11 @@ runs:
     - name: "Transform source code"
       if: inputs.php-version == '7.4' || inputs.php-version == '8.0' || inputs.php-version == '8.1'
       shell: bash
+      env:
+        TARGET_PHP_VERSION: ${{ inputs.php-version }}
       run: |
         composer install --no-interaction --no-progress --working-dir=compiler
-        ./compiler/vendor/bin/simple-downgrade downgrade -c build/downgrade.php ${{ inputs.php-version }}
+        ./compiler/vendor/bin/simple-downgrade downgrade -c build/downgrade.php "$TARGET_PHP_VERSION"
         composer dump
 
     - name: "Re-store PHP version"
diff --git a/.github/poutine.yml b/.github/poutine.yml
new file mode 100644
index 00000000000..0a0ce0f029b
--- /dev/null
+++ b/.github/poutine.yml
@@ -0,0 +1,34 @@
+# https://github.com/boostsecurityio/poutine/blob/main/.poutine.sample.yml
+
+rulesConfig:
+  pr_runs_on_self_hosted:
+    allowed_runners:
+      # GitHub-hosted arm64 runner, not a self-hosted one
+      - ubuntu-24.04-arm
+
+skip:
+  # Third-party actions in use, each pinned to a full commit SHA and reviewed
+  # whenever the pin is bumped. A newly added action still gets reported.
+  - rule: github_action_from_unverified_creator_used
+    purl:
+      - pkg:githubactions/astral-sh/setup-uv
+      - pkg:githubactions/baptiste0928/cargo-install
+      - pkg:githubactions/crate-ci/typos
+      - pkg:githubactions/crazy-max/ghaction-import-gpg
+      - pkg:githubactions/dorny/paths-filter
+      - pkg:githubactions/ilammy/msvc-dev-cmd
+      - pkg:githubactions/juliangruber/merge-pull-request-action
+      - pkg:githubactions/morishiri/block-merge-commits-action
+      - pkg:githubactions/peter-evans/create-or-update-comment
+      - pkg:githubactions/peter-evans/create-pull-request
+      - pkg:githubactions/peter-evans/repository-dispatch
+      - pkg:githubactions/ramsey/composer-install
+      - pkg:githubactions/rickstaa/action-create-tag
+      - pkg:githubactions/scholliyt/broken-links-crawler-action
+      - pkg:githubactions/shivammathur/setup-php
+      - pkg:githubactions/stefanzweifel/git-auto-commit-action
+      - pkg:githubactions/synacktiv/action-octoscan
+      - pkg:githubactions/typeddevs/bashunit
+      - pkg:githubactions/wyrihaximus/github-action-get-previous-tag
+      - pkg:githubactions/wyrihaximus/github-action-next-semvers
+      - pkg:githubactions/wyrihaximus/github-action-wait-for-status
diff --git a/.github/workflows/apiref-infra.yml b/.github/workflows/apiref-infra.yml
index 85c532de886..bd8c1e23f3b 100644
--- a/.github/workflows/apiref-infra.yml
+++ b/.github/workflows/apiref-infra.yml
@@ -15,7 +15,11 @@ on:
       - '.github/workflows/apiref-infra.yml'
       - 'apigen/infra/**'
 
-concurrency: apiref-infra
+# deploys queue up instead of cancelling one another, so a CDK deployment is never interrupted
+concurrency: apiref-infra # zizmor: ignore[concurrency-limits]
+
+permissions:
+  contents: read
 
 jobs:
   test:
@@ -32,6 +36,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install Node"
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
@@ -62,7 +68,7 @@ jobs:
     needs: test
     if: "github.event_name == 'push' && github.ref == 'refs/heads/2.3.x'"
     permissions:
-      id-token: write
+      id-token: write # assumes the deploy role in AWS through OIDC
       contents: read
 
     steps:
@@ -73,6 +79,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install Node"
         uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
diff --git a/.github/workflows/apiref.yml b/.github/workflows/apiref.yml
index 44dccf94f5c..9bf4419f2a4 100644
--- a/.github/workflows/apiref.yml
+++ b/.github/workflows/apiref.yml
@@ -21,6 +21,9 @@ concurrency:
   group: apigen-${{ github.ref }} # will be canceled on subsequent pushes in branch
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   apigen:
     name: "Run ApiGen"
@@ -36,6 +39,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -66,7 +71,7 @@ jobs:
     if: github.repository_owner == 'phpstan'
     runs-on: "ubuntu-latest"
     permissions:
-      id-token: write
+      id-token: write # assumes the deploy role in AWS through OIDC
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -87,16 +92,20 @@ jobs:
           aws-region: us-east-1
 
       - name: "Sync with S3"
+        env:
+          APIREF_BUCKET: ${{ vars.APIREF_BUCKET }}
         run: |
-          aws s3 sync ./docs "s3://${{ vars.APIREF_BUCKET }}/${{ github.ref_name }}" \
+          aws s3 sync ./docs "s3://${APIREF_BUCKET}/${GITHUB_REF_NAME}" \
             --exclude '.git*/*' \
             --follow-symlinks
 
       - name: "Invalidate CloudFront"
+        env:
+          APIREF_DISTRIBUTION_ID: ${{ vars.APIREF_DISTRIBUTION_ID }}
         run: |
           aws cloudfront create-invalidation \
-            --distribution-id "${{ vars.APIREF_DISTRIBUTION_ID }}" \
-            --paths "/${{ github.ref_name }}/*"
+            --distribution-id "${APIREF_DISTRIBUTION_ID}" \
+            --paths "/${GITHUB_REF_NAME}/*"
 
       - uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
diff --git a/.github/workflows/backward-compatibility.yml b/.github/workflows/backward-compatibility.yml
index a955e54d9ae..502f5f5e5e4 100644
--- a/.github/workflows/backward-compatibility.yml
+++ b/.github/workflows/backward-compatibility.yml
@@ -34,6 +34,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: "Install PHP"
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 0a0e7b77481..9425c25e739 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -35,6 +35,8 @@ jobs:
 
       - name: "Checkout base branch"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -73,6 +75,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
diff --git a/.github/workflows/block-merge-commits.yml b/.github/workflows/block-merge-commits.yml
index afb0a2b2878..b9fd9629276 100644
--- a/.github/workflows/block-merge-commits.yml
+++ b/.github/workflows/block-merge-commits.yml
@@ -2,6 +2,13 @@ on: pull_request
 
 name: Block merge commits
 
+concurrency:
+  group: block-merge-commits-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  pull-requests: read # Block Merge Commits lists the pull request's commits
+
 jobs:
   message-check:
     name: Block Merge Commits
diff --git a/.github/workflows/build-issue-bot.yml b/.github/workflows/build-issue-bot.yml
index bf72bf628b6..aa217670d50 100644
--- a/.github/workflows/build-issue-bot.yml
+++ b/.github/workflows/build-issue-bot.yml
@@ -43,6 +43,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -59,4 +61,6 @@ jobs:
 
       - name: "Tests"
         working-directory: "issue-bot"
-        run: ${{ matrix.script }}
+        env:
+          MATRIX_SCRIPT: ${{ matrix.script }}
+        run: '"$MATRIX_SCRIPT"'
diff --git a/.github/workflows/changelog-generator.yml b/.github/workflows/changelog-generator.yml
index 83a0818141e..92c6f1b3a93 100644
--- a/.github/workflows/changelog-generator.yml
+++ b/.github/workflows/changelog-generator.yml
@@ -36,6 +36,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
diff --git a/.github/workflows/claude-react-on-review-dispatch.yml b/.github/workflows/claude-react-on-review-dispatch.yml
index 8d91c5fb3fb..034379cad1d 100644
--- a/.github/workflows/claude-react-on-review-dispatch.yml
+++ b/.github/workflows/claude-react-on-review-dispatch.yml
@@ -1,17 +1,20 @@
 name: "Claude React On Review Dispatch"
 
-on:
-  workflow_run:
+on: # zizmor: ignore[concurrency-limits] -- one run per submitted review, none supersedes another
+  workflow_run: # zizmor: ignore[dangerous-triggers] -- runs no code from the pull request, only forwards the review's numeric IDs as quoted gh arguments
     workflows: ["Claude React On Review"]
     types: [completed]
 
+permissions:
+  contents: read
+
 jobs:
   dispatch:
+    name: dispatch
     runs-on: ubuntu-latest
     if: github.event.workflow_run.conclusion == 'success'
     permissions:
-      contents: read
-      actions: write
+      actions: read # downloads the review-context artifact of the triggering run
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
diff --git a/.github/workflows/claude-react-on-review.yml b/.github/workflows/claude-react-on-review.yml
index 36665bba8b7..e786b687374 100644
--- a/.github/workflows/claude-react-on-review.yml
+++ b/.github/workflows/claude-react-on-review.yml
@@ -1,11 +1,15 @@
 name: "Claude React On Review"
 
-on:
+on: # zizmor: ignore[concurrency-limits] -- every submitted review is handed to the dispatch workflow; a newer review does not supersede an older one
   pull_request_review:
     types: [submitted]
 
+# The artifact upload authenticates with the runner's own token, not the workflow token.
+permissions: {}
+
 jobs:
   save-context:
+    name: save-context
     runs-on: ubuntu-latest
     if: >
       github.event.pull_request.user.login == 'phpstan-bot'
@@ -19,9 +23,12 @@ jobs:
           egress-policy: audit
 
       - name: Save review context
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REVIEW_ID: ${{ github.event.review.id }}
         run: |
-          echo "${{ github.event.pull_request.number }}" > pr_number.txt
-          echo "${{ github.event.review.id }}" > review_id.txt
+          echo "$PR_NUMBER" > pr_number.txt
+          echo "$REVIEW_ID" > review_id.txt
 
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
diff --git a/.github/workflows/claude-update-config-parameters-docs-on-change.yml b/.github/workflows/claude-update-config-parameters-docs-on-change.yml
index 11d4052dc19..6547ac518d2 100644
--- a/.github/workflows/claude-update-config-parameters-docs-on-change.yml
+++ b/.github/workflows/claude-update-config-parameters-docs-on-change.yml
@@ -8,12 +8,18 @@ on:
       - '.github/workflows/claude-update-config-parameters-docs-on-change.yml'
       - 'conf/parametersSchema.neon'
 
+# The job only dispatches a workflow in phpstan-bot/phpstan-src with
+# PHPSTAN_BOT_TOKEN; it does not use the workflow token.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   fix:
+    name: "Update Config Parameters Docs"
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
diff --git a/.github/workflows/claude-update-phpdoc-tags-docs-on-change.yml b/.github/workflows/claude-update-phpdoc-tags-docs-on-change.yml
index ae799673f84..16468be70ed 100644
--- a/.github/workflows/claude-update-phpdoc-tags-docs-on-change.yml
+++ b/.github/workflows/claude-update-phpdoc-tags-docs-on-change.yml
@@ -8,12 +8,18 @@ on:
       - '.github/workflows/claude-update-phpdoc-tags-docs-on-change.yml'
       - 'src/PhpDoc/PhpDocNodeResolver.php'
 
+# The job only dispatches a workflow in phpstan-bot/phpstan-src with
+# PHPSTAN_BOT_TOKEN; it does not use the workflow token.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   fix:
+    name: "Update PHPDoc Tags Docs"
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
diff --git a/.github/workflows/claude-update-phpdoc-types-docs-on-change.yml b/.github/workflows/claude-update-phpdoc-types-docs-on-change.yml
index 984eefd6561..b677b82c4b3 100644
--- a/.github/workflows/claude-update-phpdoc-types-docs-on-change.yml
+++ b/.github/workflows/claude-update-phpdoc-types-docs-on-change.yml
@@ -8,12 +8,18 @@ on:
       - '.github/workflows/claude-update-phpdoc-types-docs-on-change.yml'
       - 'src/PhpDoc/TypeNodeResolver.php'
 
+# The job only dispatches a workflow in phpstan-bot/phpstan-src with
+# PHPSTAN_BOT_TOKEN; it does not use the workflow token.
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 jobs:
   fix:
+    name: "Update PHPDoc Types Docs"
     runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      actions: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
         uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
diff --git a/.github/workflows/close-issues-on-merge.yml b/.github/workflows/close-issues-on-merge.yml
index 460ffd30837..8eaee400080 100644
--- a/.github/workflows/close-issues-on-merge.yml
+++ b/.github/workflows/close-issues-on-merge.yml
@@ -3,12 +3,16 @@
 name: Close issues from merged PRs
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] -- runs no code from the pull request (no checkout), only reads its body and closes issues with PHPSTAN_BOT_TOKEN
     branches:
       - "2.2.x"
     types:
       - closed
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -26,8 +30,10 @@ jobs:
       - name: "Find and close linked issues"
         env:
           GH_TOKEN: ${{ secrets.PHPSTAN_BOT_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
         run: |
-          PR_BODY=$(gh pr view ${{ github.event.pull_request.number }} --repo "${{ github.repository }}" --json body --jq '.body')
+          PR_BODY=$(gh pr view "$PR_NUMBER" --repo "$GITHUB_REPOSITORY" --json body --jq '.body')
 
           # Parse "Closes/Fixes https://github.com/phpstan/phpstan/issues/123" and "Closes/Fixes phpstan/phpstan#123" patterns
           NUMBERS=$(echo "$PR_BODY" | grep -oiP '(?:closes?|fix(?:es)?)\s+(?:https://github\.com/phpstan/phpstan/issues/|phpstan/phpstan#)[0-9]+' | grep -oP '[0-9]+$' || true)
@@ -40,5 +46,5 @@ jobs:
 
           echo "$NUMBERS" | while read -r NUMBER; do
             echo "Closing phpstan/phpstan#${NUMBER}"
-            gh issue close "$NUMBER" --repo "phpstan/phpstan" --comment "Closed via merging ${{ github.event.pull_request.html_url }}"
+            gh issue close "$NUMBER" --repo "phpstan/phpstan" --comment "Closed via merging ${PR_URL}"
           done
diff --git a/.github/workflows/create-tag.yml b/.github/workflows/create-tag.yml
index 21a3e73a686..5b81f52543f 100644
--- a/.github/workflows/create-tag.yml
+++ b/.github/workflows/create-tag.yml
@@ -2,7 +2,7 @@
 
 name: "Create tag"
 
-on:
+on: # zizmor: ignore[concurrency-limits] -- manually dispatched one-off runs; a newer run does not supersede an older one
   # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_dispatch
   workflow_dispatch:
     inputs:
@@ -15,6 +15,9 @@ on:
           - patch
           - minor
 
+permissions:
+  contents: read
+
 jobs:
   create-tag:
     name: "Create tag"
@@ -26,7 +29,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] -- the persisted PHPSTAN_BOT_TOKEN credentials push the new tag
         with:
           fetch-depth: 0
           token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
diff --git a/.github/workflows/e2e-tests.yml b/.github/workflows/e2e-tests.yml
index 99db5336ea1..fe367b56677 100644
--- a/.github/workflows/e2e-tests.yml
+++ b/.github/workflows/e2e-tests.yml
@@ -1804,6 +1804,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -1824,7 +1826,9 @@ jobs:
           directory: "e2e"
 
       - name: "Test"
-        run: "${{ matrix.script }}"
+        env:
+          MATRIX_SCRIPT: ${{ matrix.script }}
+        run: eval "$MATRIX_SCRIPT"
 
   result-cache-e2e-tests-windows:
     name: "Result cache E2E tests on Windows (${{ matrix.name }})"
@@ -1896,6 +1900,8 @@ jobs:
     steps:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -1908,7 +1914,9 @@ jobs:
       - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
 
       - name: "Test"
-        run: "${{ matrix.script }}"
+        env:
+          MATRIX_SCRIPT: ${{ matrix.script }}
+        run: eval "$MATRIX_SCRIPT"
 
   e2e-tests:
     name: "E2E tests"
@@ -2188,6 +2196,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -2206,7 +2216,9 @@ jobs:
           directory: "e2e"
 
       - name: "Test"
-        run: ${{ matrix.script }}
+        env:
+          MATRIX_SCRIPT: ${{ matrix.script }}
+        run: eval "$MATRIX_SCRIPT"
 
   turbo-arena-e2e-tests:
     name: "Turbo arena E2E tests"
@@ -2222,6 +2234,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           # the extension bakes its version from `git log -- turbo-ext/src`, and
           # TurboExtensionEnabler activates only the expected version - a shallow
           # clone hands us a "dev" build, which would skip the whole test
@@ -2351,6 +2364,7 @@ jobs:
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           # the extension bakes its version from `git log -- turbo-ext/src`, and
           # TurboExtensionEnabler activates only the expected version - a shallow
           # clone hands us a "dev" build, which would skip the whole test
diff --git a/.github/workflows/issue-bot.yml b/.github/workflows/issue-bot.yml
index 7b981a85250..eb328b9a8cb 100644
--- a/.github/workflows/issue-bot.yml
+++ b/.github/workflows/issue-bot.yml
@@ -21,6 +21,9 @@ concurrency:
   group: run-issue-bot-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   download:
     name: "Download data"
@@ -38,6 +41,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -103,6 +108,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -132,15 +139,20 @@ jobs:
       - name: "Extract shard"
         working-directory: "issue-bot"
         id: chunk
+        env:
+          SHARD: ${{ matrix.shard }}
         run: |
-          echo "phpVersion=$(jq -r '.[${{ matrix.shard }}].phpVersion' matrix.json)" >> "$GITHUB_OUTPUT"
-          echo "playgroundExamples=$(jq -r '.[${{ matrix.shard }}].playgroundExamples' matrix.json)" >> "$GITHUB_OUTPUT"
-          echo "chunkNumber=$(jq -r '.[${{ matrix.shard }}].chunkNumber' matrix.json)" >> "$GITHUB_OUTPUT"
+          echo "phpVersion=$(jq -r --argjson shard "$SHARD" '.[$shard].phpVersion' matrix.json)" >> "$GITHUB_OUTPUT"
+          echo "playgroundExamples=$(jq -r --argjson shard "$SHARD" '.[$shard].playgroundExamples' matrix.json)" >> "$GITHUB_OUTPUT"
+          echo "chunkNumber=$(jq -r --argjson shard "$SHARD" '.[$shard].chunkNumber' matrix.json)" >> "$GITHUB_OUTPUT"
 
       - name: "Run PHPStan"
         working-directory: "issue-bot"
         timeout-minutes: 5
-        run: ./console.php run ${{ steps.chunk.outputs.phpVersion }} ${{ steps.chunk.outputs.playgroundExamples }}
+        env:
+          CHUNK_PHP_VERSION: ${{ steps.chunk.outputs.phpVersion }}
+          PLAYGROUND_EXAMPLES: ${{ steps.chunk.outputs.playgroundExamples }}
+        run: ./console.php run "$CHUNK_PHP_VERSION" "$PLAYGROUND_EXAMPLES"
 
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
@@ -161,6 +173,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index b5fc720c7ea..53fd2d2940d 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -8,10 +8,15 @@ on:
     branches:
       - "2.3.x"
 
+concurrency:
+  group: lint-workflows-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
+  cancel-in-progress: true
+
 permissions: {}
 
 jobs:
   actionlint:
+    name: actionlint
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
@@ -20,12 +25,16 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Register actionlint problem matcher
+        run: echo "::add-matcher::.github/actionlint-matcher.json"
+
       - name: Check workflow files
-        run: |
-          echo "::add-matcher::.github/actionlint-matcher.json"
-          bash <(curl https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
-          ./actionlint -color
-        shell: bash
+        uses: docker://rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667
+        with:
+          args: -color
 
   octoscan:
     name: Octoscan
@@ -40,11 +49,22 @@ jobs:
           egress-policy: audit
 
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
       - name: Run octoscan
         id: octoscan
         uses: synacktiv/action-octoscan@6b1cf2343893dfb9e5f75652388bd2dc83f456b0 # v1.0.0
         with:
-          filter_triggers: ''
+          # Octoscan's default: the workflows an outside contributor can
+          # trigger with elevated privileges (pull_request_target,
+          # workflow_run, ...), where its checkout, local-action and
+          # GITHUB_OUTPUT rules apply. Scanning every trigger reported those
+          # for ordinary push and pull_request workflows too.
+          filter_triggers: external
+          # Every runs-on expression resolves to a GitHub-hosted label;
+          # Poutine checks pull request workflows for self-hosted runners.
+          disable_rules: runner-label
 
       - name: Upload SARIF file to GitHub
         uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index a16f6a693b6..30a0aa6231f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -12,6 +12,9 @@ concurrency:
   group: lint-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: "Lint"
@@ -39,6 +42,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -76,6 +81,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       # only the PHP development headers are needed (php-config --includes);
       # the extension is not built here
@@ -118,6 +125,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -146,10 +155,13 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Checkout build-cs"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: "phpstan/build-cs"
           path: "build-cs"
           ref: "2.x"
@@ -190,6 +202,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -216,6 +230,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
diff --git a/.github/workflows/merge-bot-pr.yml b/.github/workflows/merge-bot-pr.yml
index 496c491237b..442a7489d12 100644
--- a/.github/workflows/merge-bot-pr.yml
+++ b/.github/workflows/merge-bot-pr.yml
@@ -6,6 +6,14 @@ on:
   pull_request:
     types:
       - opened
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+# Both steps authenticate with PHPSTAN_BOT_TOKEN, not the workflow token.
+permissions: {}
+
 jobs:
   automerge:
     name: Automerge PRs
diff --git a/.github/workflows/merge-maintained-branch.yml b/.github/workflows/merge-maintained-branch.yml
index d40e8465847..3bca865a9f6 100644
--- a/.github/workflows/merge-maintained-branch.yml
+++ b/.github/workflows/merge-maintained-branch.yml
@@ -7,6 +7,14 @@ on:
     branches:
       - "2.2.x"
 
+concurrency:
+  # a newer push to 2.2.x merges everything an older one would have
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
+# The merge is pushed with PHPSTAN_BOT_TOKEN, not the workflow token.
+permissions: {}
+
 jobs:
   merge:
     name: Merge branch
@@ -19,7 +27,7 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 # zizmor: ignore[artipacked] -- the persisted PHPSTAN_BOT_TOKEN credentials push the merge below
         with:
           fetch-depth: 0
           ref: '2.3.x'
@@ -28,5 +36,5 @@ jobs:
         run: |
           git config --global user.name "phpstan-bot"
           git config --global user.email "ondrej+phpstanbot@mirtes.cz"
-          git merge --strategy=ort origin/${{ github.ref_name }} -m "Merge branch ${{ github.ref_name }} into 2.3.x"
+          git merge --strategy=ort "origin/${GITHUB_REF_NAME}" -m "Merge branch ${GITHUB_REF_NAME} into 2.3.x"
           git push
diff --git a/.github/workflows/phar.yml b/.github/workflows/phar.yml
index 8fc1d8aa7e2..d77766075c8 100644
--- a/.github/workflows/phar.yml
+++ b/.github/workflows/phar.yml
@@ -477,7 +477,7 @@ jobs:
     # it runs on ubuntu-latest without a container and carries that core
     # over (runs-on and container cannot read env, hence the lookup of
     # ORIGIN_RUN_ID repeated in both).
-    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)] && 'ubuntu-latest' || matrix.target.runs-on }}
+    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)] && 'ubuntu-latest' || matrix.target.runs-on }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
     # Container legs pin the binaries' userland floor independently of the
     # runner image: the gnu legs run in the prebuilt ubuntu:22.04-based
     # image (.github/turbo-build/Dockerfile, published to GHCR by
@@ -485,7 +485,7 @@ jobs:
     # Ubuntu 22.04+, Debian 12+) and the jobs run no apt at all — and
     # alpine:3.24 builds the musl variant. The linux-musl-arm64 core is in
     # turbo-compile-core-musl-arm64 (see turbo-compile-musl-arm64 for why).
-    container: ${{ !(fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)]) && (matrix.target.family == 'gnu' && format('ghcr.io/phpstan/turbo-build:gnu-php{0}', matrix.target.php-version) || matrix.target.container) || '' }}
+    container: ${{ !(fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)]) && (matrix.target.family == 'gnu' && format('ghcr.io/phpstan/turbo-build:gnu-php{0}', matrix.target.php-version) || matrix.target.container) || '' }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
     needs: turbo-origins
     timeout-minutes: 30
 
@@ -498,7 +498,7 @@ jobs:
       PHP_ZTS: "0"
       TURBO_ARTIFACT: "phpstan_turbo_core-${{ matrix.target.name }}"
       PGO_PROFILE_ARTIFACT: "turbo-pgo-profile-${{ matrix.target.name }}"
-      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)] }}
+      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-{0}', matrix.target.name)] }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
 
     strategy:
       fail-fast: false
@@ -939,7 +939,8 @@ jobs:
 
       - name: "Restore the PHP build (Alpine container)"
         if: steps.alpine-php.outputs.release != ''
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # only pushes to this repository's branches can write the cache a tag build reads; pull requests write to their own scope
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # zizmor: ignore[cache-poisoning]
         with:
           path: "alpine-php-cache"
           key: "alpine-php-${{ steps.alpine-php.outputs.release }}-${{ hashFiles('.github/turbo-build/build-php.sh') }}"
@@ -1125,7 +1126,8 @@ jobs:
 
       - name: "Restore the PHP build"
         if: steps.alpine-php.outputs.release != ''
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # only pushes to this repository's branches can write the cache a tag build reads; pull requests write to their own scope
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # zizmor: ignore[cache-poisoning]
         with:
           path: "alpine-php-cache"
           key: "alpine-php-${{ steps.alpine-php.outputs.release }}-${{ hashFiles('.github/turbo-build/build-php.sh') }}"
@@ -1213,7 +1215,7 @@ jobs:
 
     env:
       GATE_ARTIFACT: "turbo-gate-fingerprint-${{ matrix.php-version }}"
-      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('turbo-gate-fingerprint-{0}', matrix.php-version)] }}
+      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('turbo-gate-fingerprint-{0}', matrix.php-version)] }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
 
     strategy:
       fail-fast: false
@@ -1514,7 +1516,7 @@ jobs:
     # the extension DLL it loads (turbo-compile-windows builds each with its
     # minor's), and a core linked with an older toolset runs on every newer
     # VC runtime.
-    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-windows-x86_64{0}', matrix.ts == 'zts' && '-zts' || '')] && 'ubuntu-latest' || 'windows-2022' }}
+    runs-on: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-windows-x86_64{0}', matrix.ts == 'zts' && '-zts' || '')] && 'ubuntu-latest' || 'windows-2022' }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
     needs: turbo-origins
     timeout-minutes: 40
 
@@ -1527,7 +1529,7 @@ jobs:
       # uses (ships bison and the unix tools phpize/configure expect).
       PHP_SDK_COMMIT: "c73faaf1cce914e2fc04da5587132f8f425996af" # php-sdk-2.7.1
       TURBO_ARTIFACT: "phpstan_turbo_core-windows-x86_64${{ matrix.ts == 'zts' && '-zts' || '' }}"
-      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-windows-x86_64{0}', matrix.ts == 'zts' && '-zts' || '')] }}
+      ORIGIN_RUN_ID: ${{ fromJSON(needs.turbo-origins.outputs.origins || '{}')[format('phpstan_turbo_core-windows-x86_64{0}', matrix.ts == 'zts' && '-zts' || '')] }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
 
     strategy:
       fail-fast: false
@@ -1586,7 +1588,7 @@ jobs:
 
       - name: "Build the core"
         if: env.ORIGIN_RUN_ID == ''
-        shell: cmd
+        shell: cmd # zizmor: ignore[obfuscation] -- the MSVC toolchain set up by msvc-dev-cmd runs from cmd
         working-directory: turbo-ext
         run: |
           for /d %%d in (C:\php-devel\php-*-devel-*) do set DEVEL=%%d
@@ -1705,7 +1707,7 @@ jobs:
         shell: bash
         env:
           MATRIX_TS: ${{ matrix.ts }}
-          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
+          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
         run: bash .github/scripts/install-php-windows-prerelease.sh
 
       - name: "Compute the extension version and download the build tools"
@@ -1713,7 +1715,7 @@ jobs:
         env:
           MATRIX_TS: ${{ matrix.ts }}
           MATRIX_VS: ${{ matrix.vs }}
-          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
+          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
         run: bash .github/scripts/download-php-windows-devel.sh
 
       # the DLL and its import library, into the extension directory where
@@ -1733,7 +1735,7 @@ jobs:
           toolset: ${{ matrix.toolset }}
 
       - name: "Build the extension"
-        shell: cmd
+        shell: cmd # zizmor: ignore[obfuscation] -- the MSVC toolchain set up by msvc-dev-cmd runs from cmd
         working-directory: turbo-ext
         env:
           VARIANT: ${{ matrix.variant }}
@@ -2056,7 +2058,7 @@ jobs:
         if: matrix.target == 'windows-x86_64' && fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]
         env:
           MATRIX_TS: ${{ matrix.ts }}
-          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
+          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
         run: bash .github/scripts/install-php-windows-prerelease.sh
 
       - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
@@ -2193,7 +2195,8 @@ jobs:
 
       - name: "Restore the PHP build"
         if: steps.alpine-php.outputs.release != ''
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        # only pushes to this repository's branches can write the cache a tag build reads; pull requests write to their own scope
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0 # zizmor: ignore[cache-poisoning]
         with:
           path: "alpine-php-cache"
           key: "alpine-php-${{ steps.alpine-php.outputs.release }}-${{ hashFiles('.github/turbo-build/build-php.sh') }}"
@@ -2330,7 +2333,7 @@ jobs:
         if: matrix.operating-system == 'windows-latest' && fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]
         env:
           MATRIX_TS: ${{ matrix.ts }}
-          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }}
+          PHP_PRERELEASE: ${{ toJSON(fromJSON(needs.php-windows-prereleases.outputs.prereleases)[matrix.php-version]) }} # zizmor: ignore[obfuscation] -- looks up this leg's entry in a JSON map output by an earlier job
         run: bash .github/scripts/install-php-windows-prerelease.sh
 
       - name: "Download extension artifact"
@@ -2828,7 +2831,7 @@ jobs:
           ref: 2.3.x
           # deliberately persisted: the push steps below authenticate with
           # this bot token
-          persist-credentials: true
+          persist-credentials: true # zizmor: ignore[artipacked]
 
       - name: "Get previous pushed dist commit"
         id: previous-commit
diff --git a/.github/workflows/pr-base-on-previous-branch.yml b/.github/workflows/pr-base-on-previous-branch.yml
index 377b54af399..d110d01edeb 100644
--- a/.github/workflows/pr-base-on-previous-branch.yml
+++ b/.github/workflows/pr-base-on-previous-branch.yml
@@ -3,13 +3,17 @@
 name: "Base PR on previous branch"
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] -- runs no code from the pull request (no checkout), only comments with PHPSTAN_BOT_TOKEN
     types:
       - opened
     branches:
       - '2.4.x'
 
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/pr-marked-as-ready.yml b/.github/workflows/pr-marked-as-ready.yml
index 30a0dc05aaf..a5440597cb2 100644
--- a/.github/workflows/pr-marked-as-ready.yml
+++ b/.github/workflows/pr-marked-as-ready.yml
@@ -3,10 +3,14 @@
 name: "Pull request ready for review"
 
 on:
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] -- runs no code from the pull request (no checkout), only comments with PHPSTAN_BOT_TOKEN
     types:
       - ready_for_review
 
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
diff --git a/.github/workflows/reflection-golden-test.yml b/.github/workflows/reflection-golden-test.yml
index 5d128b02047..dce2a8ab620 100644
--- a/.github/workflows/reflection-golden-test.yml
+++ b/.github/workflows/reflection-golden-test.yml
@@ -26,6 +26,9 @@ concurrency:
   group: reflection-golden-test-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   dump-php-symbols:
     name: "Dump PHP symbols"
@@ -39,6 +42,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -88,6 +93,7 @@ jobs:
       - name: "Checkout base commit"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.base.sha || github.event.before }}
 
       - name: "Install PHP"
@@ -112,6 +118,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - uses: "ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda" # v4.0.0
 
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 60794d15614..fcc59aead35 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -8,6 +8,10 @@ on:
     branches:
       - "2.3.x"
 
+concurrency:
+  group: spelling-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -24,6 +28,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Check for typos"
         uses: "crate-ci/typos@7f9d0819ca1c008ade73f4b41fa9d258d48f605b" # v1.51.1
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index b048197217d..05ca3e46213 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -18,6 +18,9 @@ concurrency:
   group: sa-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   static-analysis:
     name: "PHPStan"
@@ -46,6 +49,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -81,7 +86,9 @@ jobs:
 
       - name: "Generate baseline"
         if: failure() && (matrix.php-version == '7.4' || matrix.php-version == '8.0' || matrix.php-version == '8.1')
-        run: "php -d memory_limit=599M bin/phpstan analyse --generate-baseline baseline-php-${{ matrix.php-version }}.neon"
+        env:
+          MATRIX_PHP_VERSION: ${{ matrix.php-version }}
+        run: "php -d memory_limit=599M bin/phpstan analyse --generate-baseline baseline-php-${MATRIX_PHP_VERSION}.neon"
 
       - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: ${{ failure() }}
@@ -113,6 +120,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -155,6 +164,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -185,6 +196,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 0a6d1ba196f..7fd19751318 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -22,6 +22,9 @@ concurrency:
   group: tests-${{ github.head_ref || github.run_id }} # will be canceled on subsequent pushes in pull requests but not branches
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   tests:
     name: "Tests PHPUnit 12.x"
@@ -46,6 +49,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -89,6 +94,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -126,6 +133,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -158,6 +167,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -197,6 +208,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -214,7 +227,9 @@ jobs:
         run: "vendor/bin/phpunit --check-php-configuration"
 
       - name: "Tests"
-        run: "${{ matrix.script }}"
+        env:
+          MATRIX_SCRIPT: ${{ matrix.script }}
+        run: eval "$MATRIX_SCRIPT"
 
   tests-with-old-phpunit:
     name: "Tests with old PHPUnit"
@@ -241,6 +256,8 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
@@ -336,10 +353,13 @@ jobs:
 
       - name: "Checkout"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: "Checkout build-infection"
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          persist-credentials: false
           repository: "phpstan/build-infection"
           path: "build-infection"
           ref: "1.x"
diff --git a/.github/workflows/turbo-build-image.yml b/.github/workflows/turbo-build-image.yml
index c979cfbe981..44ea9971662 100644
--- a/.github/workflows/turbo-build-image.yml
+++ b/.github/workflows/turbo-build-image.yml
@@ -41,7 +41,7 @@ jobs:
     timeout-minutes: 30
     permissions:
       contents: read
-      packages: write
+      packages: write # pushes the per-architecture image to GHCR
 
     strategy:
       fail-fast: false
@@ -89,7 +89,9 @@ jobs:
       # only pushes to 2.3.x (and the cron/manual runs) publish.
       - name: "Log in to GHCR"
         if: github.event_name != 'pull_request'
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
 
       - name: "Push"
         if: github.event_name != 'pull_request'
@@ -102,7 +104,7 @@ jobs:
     runs-on: "ubuntu-latest"
     timeout-minutes: 10
     permissions:
-      packages: write
+      packages: write # pushes the multi-arch manifest to GHCR
 
     strategy:
       matrix:
@@ -118,7 +120,9 @@ jobs:
           egress-policy: audit
 
       - name: "Log in to GHCR"
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u "${{ github.actor }}" --password-stdin
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: echo "$GITHUB_TOKEN" | docker login ghcr.io -u "$GITHUB_ACTOR" --password-stdin
 
       - name: "Create and push the manifest"
         run: docker buildx imagetools create -t "$TAG" "$TAG-amd64" "$TAG-arm64"
diff --git a/.github/workflows/update-phpstorm-stubs.yml b/.github/workflows/update-phpstorm-stubs.yml
index b167993fd56..b8f5011aeea 100644
--- a/.github/workflows/update-phpstorm-stubs.yml
+++ b/.github/workflows/update-phpstorm-stubs.yml
@@ -7,6 +7,10 @@ on:
     # * is a special character in YAML so you have to quote this string
     - cron: '0 0 * * 2'
 
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: true
+
 permissions:
   contents: read
 
@@ -27,6 +31,7 @@ jobs:
           ref: 2.3.x
           fetch-depth: '0'
           token: ${{ secrets.PHPSTAN_BOT_TOKEN }}
+          persist-credentials: false
       - name: "Install PHP"
         uses: "shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962" # 2.40.0
         with:
@@ -38,6 +43,7 @@ jobs:
         with:
           path: "phpstorm-stubs"
           repository: "jetbrains/phpstorm-stubs"
+          persist-credentials: false
       - name: "Update stubs"
         run: "composer require \"jetbrains/phpstorm-stubs:dev-master#$(git -C phpstorm-stubs rev-parse HEAD)\""
       - name: "Remove stubs repo"