diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 57d84104..54275600 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,8 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       aws:
         patterns:
@@ -27,6 +29,8 @@ updates:
     directory: "/"
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
     groups:
       promci:
         patterns:
@@ -42,3 +46,4 @@ updates:
       - .github/workflows/govulncheck.yml
       - .github/workflows/scorecards.yml
       - .github/workflows/stale.yml
+      - .github/workflows/zizmor.yml
diff --git a/.github/workflows/approve-workflows.yml b/.github/workflows/approve-workflows.yml
index 697118df..cfbb86ea 100644
--- a/.github/workflows/approve-workflows.yml
+++ b/.github/workflows/approve-workflows.yml
@@ -5,7 +5,8 @@
 name: Approve pending workflows
 
 on:
-  issue_comment:
+  # The pinned action requires triage access or higher and only calls GitHub APIs.
+  issue_comment: # zizmor: ignore[dangerous-triggers]
     types: [created]
 
 permissions: read-all
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index af92ba9f..27bf0328 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,9 @@ jobs:
     container:
       image: quay.io/prometheus/golang-builder:${{ matrix.go_version }}-base
     steps:
-      - name: Checkout repository
+      # Checkout v7 stores credentials in RUNNER_TEMP; this read-only job
+      # uploads no artifacts and only caches Go build and module directories.
+      - name: Checkout repository # zizmor: ignore[artipacked]
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - uses: prometheus/promci-setup@55bd31fe92710532260eb57c554f2697363285c5 # v0.2.2
       - run: make test
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 77727fe2..61d5b05e 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -20,10 +20,16 @@ on:
   schedule:
     - cron: '26 14 * * 1'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    permissions:
+      contents: read  # for actions/checkout
+      security-events: write  # for uploading CodeQL results
 
     strategy:
       fail-fast: false
@@ -34,7 +40,9 @@ jobs:
         # https://docs.github.com/en/free-pro-team@latest/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#changing-the-languages-that-are-analyzed
 
     steps:
-      - name: Checkout repository
+      # Checkout v7 stores credentials in RUNNER_TEMP; CodeQL uploads only
+      # analysis results, database bundles and logs, not the credentials file.
+      - name: Checkout repository # zizmor: ignore[artipacked]
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       # Initializes the CodeQL tools for scanning.
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index a2d392e1..d6bad976 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -29,7 +29,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - name: Install Go
+      # Go caching is acceptable here because this workflow has a read-only
+      # token, uses no secrets and publishes nothing.
+      - name: Install Go # zizmor: ignore[cache-poisoning]
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: 1.27.x
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 00000000..ac67240f
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,84 @@
+---
+# This workflow runs zizmor to find security issues in GitHub Actions workflows.
+# It is synchronized from https://github.com/prometheus/prometheus.
+#
+# If the "GitHub Actions Security" check fails:
+#
+# 1. Open the "Run zizmor" step in the failed job. Each finding identifies
+#    a rule, the affected file and line, and the reason for the finding.
+#    The scan can report existing issues in files your PR did not change.
+#
+# 2. Find guidance for the reported rule at https://docs.zizmor.sh/audits/.
+#    Fix the affected workflow and push your changes to rerun the check.
+#
+# 3. To reproduce locally, install the zizmor version specified below using
+#    the instructions at https://docs.zizmor.sh/installation/.
+#    From the repository root, run `zizmor .`.
+#    Some findings can be fixed with `zizmor --fix=safe .`.
+#    Review the resulting diff and verify that the workflows still work.
+#
+# If a finding appears incorrect or a fix is unclear, ask the repository
+# maintainers before adding an exception. Document the reason for any exception
+# and keep it scoped to the specific finding. See the configuration reference
+# at https://docs.zizmor.sh/configuration/.
+#
+# Propose changes to this shared workflow in prometheus/prometheus so they
+# can be synchronized across repositories.
+name: GitHub Actions Security
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+
+permissions:
+  contents: read
+  actions: read
+
+jobs:
+  zizmor:
+    name: Run zizmor
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        id: zizmor
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        with:
+          advanced-security: false
+          version: 1.31.1
+
+      - name: Explain how to resolve findings
+        if: failure() && steps.zizmor.outcome == 'failure'
+        run: |
+          cat >> "$GITHUB_STEP_SUMMARY" <<'EOF'
+          ### Troubleshooting GitHub Actions Security
+
+          Open the **Run zizmor** step for the findings or execution error.
+          Each finding identifies the affected file, line, and rule.
+          The scan can report existing issues in files your PR did not change.
+
+          1. Follow the [guidance for the reported rule](https://docs.zizmor.sh/audits/).
+          2. Fix the affected workflow and push your changes to rerun the check.
+
+          To reproduce locally, [install zizmor](https://docs.zizmor.sh/installation/)
+          using the version specified in this workflow and run `zizmor .` from
+          the repository root. Some findings can be fixed with `zizmor --fix=safe .`.
+          Review the resulting diff and verify that the workflows still work.
+
+          If a finding appears incorrect or a fix is unclear, ask the repository
+          maintainers before adding an exception. Document the reason and keep
+          the exception scoped to the specific finding. See the
+          [configuration reference](https://docs.zizmor.sh/configuration/).
+
+          This workflow is synchronized from [prometheus/prometheus](https://github.com/prometheus/prometheus).
+          Propose shared workflow changes there so they can reach all repositories.
+          EOF
diff --git a/Makefile.common b/Makefile.common
index efc2730c..bd5230e4 100644
--- a/Makefile.common
+++ b/Makefile.common
@@ -352,8 +352,7 @@ common-docker-manifest:
 				echo "Skipping manifest for $$variant_name variant (no supported architectures)"; \
 				continue; \
 			fi; \
-			DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)-$$variant_name" $$refs; \
-			DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)-$$variant_name"; \
+			docker buildx imagetools create -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)-$$variant_name" $$refs; \
 		fi; \
 		if [ "$$dockerfile" = "Dockerfile" ]; then \
 			echo "Creating default variant ($$variant_name) manifest"; \
@@ -365,8 +364,7 @@ common-docker-manifest:
 				echo "Skipping default variant manifest (no supported architectures)"; \
 				continue; \
 			fi; \
-			DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)" $$refs; \
-			DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)"; \
+			docker buildx imagetools create -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)" $$refs; \
 		fi; \
 		if [ "$(DOCKER_IMAGE_TAG)" = "latest" ]; then \
 			if [ "$$dockerfile" != "Dockerfile" ] || [ "$$variant_name" != "default" ]; then \
@@ -379,8 +377,7 @@ common-docker-manifest:
 					echo "Skipping version-tag manifest for $$variant_name variant (no supported architectures)"; \
 					continue; \
 				fi; \
-				DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):v$(DOCKER_MAJOR_VERSION_TAG)-$$variant_name" $$refs; \
-				DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):v$(DOCKER_MAJOR_VERSION_TAG)-$$variant_name"; \
+				docker buildx imagetools create -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):v$(DOCKER_MAJOR_VERSION_TAG)-$$variant_name" $$refs; \
 			fi; \
 			if [ "$$dockerfile" = "Dockerfile" ]; then \
 				echo "Creating default variant version tag manifest"; \
@@ -392,8 +389,7 @@ common-docker-manifest:
 					echo "Skipping default variant version-tag manifest (no supported architectures)"; \
 					continue; \
 				fi; \
-				DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):v$(DOCKER_MAJOR_VERSION_TAG)" $$refs; \
-				DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):v$(DOCKER_MAJOR_VERSION_TAG)"; \
+				docker buildx imagetools create -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):v$(DOCKER_MAJOR_VERSION_TAG)" $$refs; \
 			fi; \
 		fi; \
 	done