diff --git a/.github/workflows/add-contributor.yml b/.github/workflows/add-contributor.yml
index dac869c2..fddf0d91 100644
--- a/.github/workflows/add-contributor.yml
+++ b/.github/workflows/add-contributor.yml
@@ -4,7 +4,7 @@ on:
   # pull_request_target is required (instead of pull_request) so that
   # GITHUB_TOKEN has write permissions even when the merged PR came from a fork.
   # No untrusted code is checked out here, so this is safe.
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types: [closed]
     branches: [main]
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 00000000..c9aab8ca
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,43 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  gate:
+    runs-on: ubuntu-latest
+    if: ${{ !startsWith(github.head_ref, 'release-please--') && !startsWith(github.ref, 'refs/heads/release-please--') }}
+    steps:
+      - run: true
+
+  phpcs:
+    needs: gate
+    uses: ./.github/workflows/phpcs.yml
+
+  phpstan:
+    needs: gate
+    uses: ./.github/workflows/phpstan.yml
+
+  phpunit:
+    needs: gate
+    uses: ./.github/workflows/phpunit.yml
+    secrets:
+      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+
+  multisite:
+    needs: gate
+    uses: ./.github/workflows/multisite.yml
+
+  plugin-check:
+    needs: gate
+    uses: ./.github/workflows/plugin-check.yml
diff --git a/.github/workflows/deploy-wporg.yml b/.github/workflows/deploy-wporg.yml
index a221f6cc..5f9e78b5 100644
--- a/.github/workflows/deploy-wporg.yml
+++ b/.github/workflows/deploy-wporg.yml
@@ -47,8 +47,9 @@ jobs:
           fi
           printf 'ref=refs/tags/%s\n' "$TAG" >> "$GITHUB_OUTPUT"
           printf 'version=%s\n' "${TAG#v}" >> "$GITHUB_OUTPUT"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           ref: ${{ steps.inputs.outputs.ref }}
       - name: Deploy to WordPress.org Plugin Directory
         uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # stable
diff --git a/.github/workflows/multisite.yml b/.github/workflows/multisite.yml
index 56200a0f..43b049da 100644
--- a/.github/workflows/multisite.yml
+++ b/.github/workflows/multisite.yml
@@ -1,34 +1,27 @@
 name: Multisite
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   multisite:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
       - run: npm ci
-      # Avoids the intermittent 504s on api.github.com during wp-env's
-      # Docker build (PR #22). Authenticated requests dodge the issue.
       - name: Authenticate composer to GitHub
         run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}'
       - run: npx wp-env start
diff --git a/.github/workflows/phpcs.yml b/.github/workflows/phpcs.yml
index bfd7393c..80f9d1d4 100644
--- a/.github/workflows/phpcs.yml
+++ b/.github/workflows/phpcs.yml
@@ -1,28 +1,23 @@
 name: PHPCS
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   phpcs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.composer/cache
           key: composer-${{ hashFiles('composer.json') }}
diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index 32b2e02f..64ef1924 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -1,28 +1,23 @@
 name: PHPStan
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   phpstan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
-      - uses: actions/cache@v6
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
         with:
           path: ~/.composer/cache
           key: composer-${{ hashFiles('composer.json') }}
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index b3947f30..f5afb98a 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -1,18 +1,14 @@
 name: PHPUnit
 
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
+  workflow_call:
+    secrets:
+      CODECOV_TOKEN:
+        required: true
 
 permissions:
   contents: read
 
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
   phpunit:
     name: PHP ${{ matrix.php }}
@@ -25,18 +21,18 @@ jobs:
           - php: '8.3'
             coverage: true
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
           cache: npm
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
       - run: npm ci
-      # Avoids the intermittent 504s on api.github.com during wp-env's
-      # Docker build (PR #22). Authenticated requests dodge the issue.
       - name: Authenticate composer to GitHub
         run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}'
       - run: npx wp-env start ${{ matrix.coverage && '--xdebug=coverage' || '' }}
@@ -46,7 +42,7 @@ jobs:
       - run: npx wp-env run tests-cli --env-cwd='wp-content/plugins/presence-api' -- /var/www/html/vendor/bin/phpunit ${{ matrix.coverage && '--coverage-clover coverage.xml' || '' }}
       - name: Upload coverage to Codecov
         if: ${{ matrix.coverage }}
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.xml
diff --git a/.github/workflows/playground-preview.yml b/.github/workflows/playground-preview.yml
index 4598b647..da0bd0f1 100644
--- a/.github/workflows/playground-preview.yml
+++ b/.github/workflows/playground-preview.yml
@@ -33,11 +33,12 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ !startsWith(github.head_ref, 'release-please--') }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
@@ -93,20 +94,23 @@ jobs:
       # PR metadata as JSON (no shell-`source` upstream). The publish
       # workflow validates these fields with regex before using.
       - name: Save PR metadata
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           jq -n \
-            --argjson pr "${{ github.event.pull_request.number }}" \
-            --arg sha "${{ github.event.pull_request.head.sha }}" \
+            --argjson pr "$PR_NUMBER" \
+            --arg sha "$HEAD_SHA" \
             '{pr_number: $pr, head_sha: $sha}' > pr-meta.json
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: release-assets
           path: release-assets/
           retention-days: 14
           if-no-files-found: error
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: pr-meta
           path: pr-meta.json
diff --git a/.github/workflows/plugin-check.yml b/.github/workflows/plugin-check.yml
index e4d555cf..10c63b24 100644
--- a/.github/workflows/plugin-check.yml
+++ b/.github/workflows/plugin-check.yml
@@ -1,20 +1,7 @@
 name: Plugin Check
 
-# Runs the WordPress.org Plugin Check suite against the staged plugin —
-# the same checks the directory's automated review applies on submission.
-# Surfaces missing `readme.txt` fields, license-header issues, forbidden
-# function calls, and similar guideline violations before they become a
-# submission blocker.
-
 on:
-  push:
-    branches: [ main ]
-  pull_request:
-    branches: [ main ]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  workflow_call:
 
 permissions:
   contents: read
@@ -23,56 +10,43 @@ jobs:
   plugin-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-      - uses: shivammathur/setup-php@v2
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
 
-      # Match `release.yml` — no dev deps, optimized autoloader, scripts
-      # disabled — so what's checked is what would ship.
       - run: composer install --no-dev --no-interaction --optimize-autoloader --no-scripts
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
 
       - run: npm install -g @wordpress/env@11.8.1
 
-      # Avoids the intermittent 504s on api.github.com during wp-env's
-      # Docker build (PR #22). Authenticated requests dodge the issue.
       - name: Authenticate composer to GitHub
         run: composer config --global --auth github-oauth.github.com '${{ secrets.GITHUB_TOKEN }}'
 
-      # Build the plugin tree the same way `release.yml` does so
-      # plugin-check sees only what would actually ship — `.distignore`
-      # excludes `.wp-env.json`, the `*.dist` configs, tests, and other
-      # dev files that the live WP.org plugin directory wouldn't see.
-      - name: Build the plugin
+      - name: Build plugin
         run: |
           mkdir -p build/presence-api
           rsync -a --exclude-from='.distignore' --exclude='build' ./ build/presence-api/
 
-      # Point wp-env at the built tree instead of the repo root so the
-      # `presence-api` slug it loads is the directory plugin-check
-      # should be analyzing.
-      - name: Mount the built plugin into wp-env
+      - name: Configure wp-env to mount built plugin
         run: |
           cat > .wp-env.override.json <<'JSON'
           { "plugins": [ "./build/presence-api" ] }
           JSON
 
-      - run: wp-env start --update
+      - run: wp-env start
 
-      - name: Install Plugin Check inside wp-env
+      - name: Install Plugin Check
         run: |
           wp-env run cli wp plugin install plugin-check --activate
           wp-env run cli wp plugin activate presence-api
 
-      # `strict-table` is the only built-in format that's human-readable
-      # in CI logs and exits non-zero when errors are found. (Plain
-      # `table` always exits 0 even with findings.)
       - name: Run Plugin Check
-        run: |
-          wp-env run cli wp plugin check presence-api --format=strict-table
+        run: wp-env run cli wp plugin check presence-api --format=strict-table
diff --git a/.github/workflows/props-bot.yml b/.github/workflows/props-bot.yml
index 4d0bc056..489e6f17 100644
--- a/.github/workflows/props-bot.yml
+++ b/.github/workflows/props-bot.yml
@@ -7,7 +7,7 @@ on:
   # Note: The pull_request_target event is used instead of pull_request because this workflow needs permission to comment
   # on the pull request. Because this event grants extra permissions to `GITHUB_TOKEN`, any code changes within the PR
   # should be considered untrusted. See https://securitylab.github.com/research/github-actions-preventing-pwn-requests/.
-  pull_request_target:
+  pull_request_target: # zizmor: ignore[dangerous-triggers]
     types:
       - opened
       - synchronize
@@ -73,7 +73,7 @@ jobs:
 
     steps:
       - name: Gather a list of contributors
-        uses: WordPress/props-bot-action@trunk
+        uses: WordPress/props-bot-action@trunk # zizmor: ignore[unpinned-uses]
         with:
           format: 'svn'
 
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 09c2d336..61d66c43 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -8,13 +8,15 @@ on:
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
-permissions:
-  contents: write
-  pull-requests: write
+
+permissions: {}
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: write
     outputs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
@@ -25,7 +27,7 @@ jobs:
       # disabled (and it's locked at the org level here). Authenticate with a
       # PAT or GitHub App token stored in the RELEASE_PLEASE_TOKEN secret so
       # the release PR can be created.
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5
         id: release
         with:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
@@ -39,18 +41,24 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.pr }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           ref: ${{ fromJSON(needs.release-please.outputs.pr).headBranchName }}
       - run: bash scripts/sync-versions.sh
       - name: Commit synced versions back to the release PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           if ! git diff --quiet; then
             git config user.name "github-actions[bot]"
             git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
             git add presence-api.php readme.txt
             git commit -m "chore: sync versions across plugin file and readme"
+            gh auth setup-git
             git push
           fi
 
@@ -64,8 +72,10 @@ jobs:
       pull-requests: write
       contents: read
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/github-script@v8
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         env:
           PROPS_SORT_LAST: ${{ vars.PROPS_SORT_LAST }}
           PR_NUMBER: ${{ fromJSON(needs.release-please.outputs.pr).number }}
@@ -80,9 +90,13 @@ jobs:
     needs: release-please
     if: ${{ needs.release-please.outputs.release_created }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
-      - uses: actions/checkout@v7
-      - uses: shivammathur/setup-php@v2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.3'
           tools: composer
@@ -102,4 +116,6 @@ jobs:
     uses: ./.github/workflows/deploy-wporg.yml
     with:
       tag: ${{ needs.release-please.outputs.tag_name }}
-    secrets: inherit
+    secrets:
+      WPORG_SVN_PASSWORD: ${{ secrets.WPORG_SVN_PASSWORD }}
+      WPORG_SVN_USERNAME: ${{ secrets.WPORG_SVN_USERNAME }}
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 9ca38890..accdc1f2 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -16,7 +16,9 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Search for misspellings
         uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
diff --git a/.github/workflows/workflow-scripts.yml b/.github/workflows/workflow-scripts.yml
index 144eb1a2..36904331 100644
--- a/.github/workflows/workflow-scripts.yml
+++ b/.github/workflows/workflow-scripts.yml
@@ -22,7 +22,9 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Run tests
         run: node --test .github/scripts/*.test.js
diff --git a/README.md b/README.md
index 9499e36c..74fdac90 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,6 @@
 # Presence API
 
-[![PHPCS](https://github.com/WordPress/presence-api/actions/workflows/phpcs.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/phpcs.yml) [![PHPUnit](https://github.com/WordPress/presence-api/actions/workflows/phpunit.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/phpunit.yml) [![Multisite](https://github.com/WordPress/presence-api/actions/workflows/multisite.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/multisite.yml)
+[![CI](https://github.com/WordPress/presence-api/actions/workflows/ci.yml/badge.svg)](https://github.com/WordPress/presence-api/actions/workflows/ci.yml)
 
 > **Status:** Experimental feature plugin