diff --git a/.github/workflows/calver-release.yml b/.github/workflows/calver-release.yml
index 590c638..77a39c1 100644
--- a/.github/workflows/calver-release.yml
+++ b/.github/workflows/calver-release.yml
@@ -71,7 +71,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0  # need tags for sequence calculation
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0b44443..5afbb3c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Run actionlint
         env:
@@ -44,7 +44,7 @@ jobs:
           ./actionlint -color
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Unit-test the shared CI scripts
         run: uv run --with pyyaml --with pytest --python 3.12 -m pytest tests/ -q
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index dbc11f1..fd82352 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -72,10 +72,10 @@ jobs:
     runs-on: ${{ inputs.runs-on }}
     steps:
       - name: Check out the calling repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Check out the shared CI scripts
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           repository: mindsdb/github-actions
           path: .ci-shared
@@ -92,7 +92,7 @@ jobs:
           ./actionlint -color
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v7
 
       - name: Check that every reusable call composes
         env:
@@ -160,18 +160,43 @@ jobs:
 
           if [ "$BLOCKING" = "true" ]; then
             uvx "zizmor@${VERSION}" "${CFG[@]}" --persona="$PERSONA" .github/workflows
-          else
-            # Advisory: report and move on. The findings land in the log and the
-            # step summary either way, so turning this into a gate later is a
-            # one-line input change rather than a discovery exercise.
-            uvx "zizmor@${VERSION}" "${CFG[@]}" --persona="$PERSONA" .github/workflows | tee zizmor.out || true
-            {
-              echo "### zizmor (advisory)"
-              echo
-              echo '```'
-              tail -40 zizmor.out
-              echo '```'
-              echo
-              echo "Set \`zizmor-blocking: true\` on the caller once these are triaged."
-            } >> "$GITHUB_STEP_SUMMARY"
+            exit 0
           fi
+
+          # Advisory: report and move on. Turning this into a gate later is a
+          # one-line input change on the caller rather than a discovery exercise.
+          uvx "zizmor@${VERSION}" "${CFG[@]}" --persona="$PERSONA" .github/workflows | tee zizmor.out || true
+          uvx "zizmor@${VERSION}" "${CFG[@]}" --persona="$PERSONA" --format json .github/workflows > zizmor.json 2>/dev/null || true
+
+          # A count per rule, not a `tail -40`. An advisory backlog is a hundred
+          # findings from a handful of rules, and the arbitrary last-40-lines
+          # window showed neither how big it was nor what it consisted of — just
+          # whichever three findings happened to sort last. What a reader needs
+          # first is which rules are firing and how much each one owes, and only
+          # then the raw output, which is why that goes in a <details>.
+          {
+            echo "### zizmor (advisory)"
+            echo
+            if [ -s zizmor.json ] && jq -e 'type == "array"' zizmor.json > /dev/null 2>&1; then
+              echo "| rule | severity | count |"
+              echo "|---|---|---:|"
+              jq -r 'group_by(.ident + .determinations.severity)
+                     | map({rule: .[0].ident, sev: .[0].determinations.severity, n: length})
+                     | sort_by(-.n)[]
+                     | "| [\(.rule)](https://docs.zizmor.sh/audits/#\(.rule)) | \(.sev) | \(.n) |"' zizmor.json
+              echo
+              echo "**$(jq 'length' zizmor.json) reported.**"
+            else
+              echo "_(no machine-readable output; see the log)_"
+            fi
+            echo
+            echo "<details><summary>Full zizmor output</summary>"
+            echo
+            echo '```'
+            cat zizmor.out
+            echo '```'
+            echo
+            echo "</details>"
+            echo
+            echo "Set \`zizmor-blocking: true\` on the caller once these are triaged."
+          } >> "$GITHUB_STEP_SUMMARY"
diff --git a/build-push-ecr/action.yml b/build-push-ecr/action.yml
index d60402b..e02232f 100644
--- a/build-push-ecr/action.yml
+++ b/build-push-ecr/action.yml
@@ -36,7 +36,7 @@ runs:
     - uses: FranzDiebold/github-env-vars-action@v2
     # https://github.com/aws-actions/amazon-ecr-login
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
     - name: Login to Amazon ECR
       id: login-ecr
       uses: aws-actions/amazon-ecr-login@v2
diff --git a/docker-bake/action.yml b/docker-bake/action.yml
index 272d0a8..064bcbe 100644
--- a/docker-bake/action.yml
+++ b/docker-bake/action.yml
@@ -31,7 +31,7 @@ runs:
     # Get clean environment variables via https://github.com/marketplace/actions/github-environment-variables-action
     - uses: FranzDiebold/github-env-vars-action@v2
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@v4
       with:
         driver: remote
         endpoint: tcp://remote-buildkit-agent.infrastructure.svc.cluster.local:80