diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
new file mode 100644
index 0000000..aec1428
--- /dev/null
+++ b/.github/workflows/lint-workflows.yml
@@ -0,0 +1,52 @@
+name: 'Lint Workflows'
+on:
+  pull_request:
+    branches:
+      - 'master'
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  actionlint:
+    name: 'actionlint'
+    runs-on: ubuntu-latest
+    steps:
+      - name: 'Check out code'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: 'Install actionlint'
+        env:
+          # Pin the release and verify it, both values should be updated together.
+          ACTIONLINT_VERSION: '1.7.12'
+          ACTIONLINT_SHA256: '8aca8db96f1b94770f1b0d72b6dddcb1ebb8123cb3712530b08cc387b349a3d8'
+        run: |
+          set -euxo pipefail
+          curl --fail --silent --show-error --location --output actionlint.tar.gz \
+            "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          echo "${ACTIONLINT_SHA256}  actionlint.tar.gz" | sha256sum --check --strict
+          tar --extract --gzip --file actionlint.tar.gz actionlint
+      - name: 'Run actionlint'
+        run: ./actionlint -color
+
+  zizmor:
+    name: 'zizmor'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write  # upload SARIF, so findings annotate the diff
+    steps:
+      - name: 'Check out code'
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: 'Run zizmor'
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2
+        with:
+          version: '1.29.0'
+          online-audits: false
+          advanced-security: true
diff --git a/.github/workflows/master-push.yml b/.github/workflows/master-push.yml
deleted file mode 100644
index 1ac3067..0000000
--- a/.github/workflows/master-push.yml
+++ /dev/null
@@ -1,53 +0,0 @@
-name: 'Master Push'
-on:
-  push:
-    branches:
-      - master
-
-jobs:
-  nix-flake-release:
-    name: 'Nix flake release'
-    strategy:
-      matrix:
-        include:
-          - runner: ubuntu-latest
-            os: ubuntu-latest
-          - runner: macos-15
-            os: macos-15
-          - runner: self-macos-latest
-            os: self-macos-latest
-    runs-on: ${{ matrix.runner }}
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v3
-
-      - name: 'Upgrade bash'
-        if: ${{ contains(matrix.os, 'macos') }}
-        run: brew install bash
-
-      - name: 'Install Nix/Cachix'
-        if: ${{ !startsWith(matrix.os, 'self') }}
-        uses: cachix/install-nix-action@v31.7.0
-        with:
-          install_url: https://releases.nixos.org/nix/nix-2.32.0/install
-          extra_nix_config:
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-
-      - if: ${{ !startsWith(matrix.os, 'self') }}
-        uses: cachix/cachix-action@v12
-        with:
-          name: k-framework
-          authToken: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
-          skipPush: true
-
-      - name: 'Build and cache kup'
-        uses: workflow/nix-shell-action@v3
-        env:
-          GC_DONT_GC: 1
-          CACHIX_AUTH_TOKEN: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
-        with:
-          packages: jq
-          script: |
-            kup=$(nix build .#kup --json | jq -r '.[].outputs | to_entries[].value')
-            drv=$(nix-store --query --deriver ${kup})
-            nix-store --query --requisites --include-outputs ${drv} | cachix push k-framework
diff --git a/.github/workflows/test-pr.yml b/.github/workflows/test-pr.yml
index 7b21f67..72084ff 100644
--- a/.github/workflows/test-pr.yml
+++ b/.github/workflows/test-pr.yml
@@ -8,6 +8,11 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
+# No job here writes to the repository, so the token stays read-only regardless of
+# the repository default.
+permissions:
+  contents: read
+
 jobs:
 
   build-and-test:
@@ -15,28 +20,28 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Check out code'
-        uses: actions/checkout@v3
-      - name: 'Install Nix/Cachix'
-        uses: cachix/install-nix-action@v31.7.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
-          install_url: https://releases.nixos.org/nix/nix-2.32.0/install
-          extra_nix_config:
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-      - uses: cachix/cachix-action@v12
+          persist-credentials: false
+      # k-framework is a public cache, so it is declared as a substituter directly
+      # rather than through cachix-action, which needs no auth token this way.
+      - name: 'Install Nix'
+        uses: cachix/install-nix-action@9280e7aca88deada44c930f1e2c78e21c3ae3edd  # v31.7.0
         with:
-          name: k-framework
-          signingKey: '${{ secrets.CACHIX_PUBLIC_TOKEN }}'
-          skipPush: true
+          install_url: https://releases.nixos.org/nix/nix-2.32.0/install
+          extra_nix_config: |
+            substituters = https://cache.nixos.org https://k-framework.cachix.org
+            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= k-framework.cachix.org-1:jeyMXB2h28gpNRjuVkehg+zLj62ma1RnyyopA/20yFE=
       - name: 'Install Python'
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: '3.10'
       - name: 'Get uv release'
         id: uv_release
         run: |
-          echo uv_version=$(cat deps/uv_release) >> "${GITHUB_OUTPUT}"
+          echo "uv_version=$(cat deps/uv_release)" >> "${GITHUB_OUTPUT}"
       - name: 'Install uv'
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9  # v9.0.0
         with:
           version: ${{ steps.uv_release.outputs.uv_version }}
       - name: 'Run code quality checks'
diff --git a/.github/workflows/update-version.yml b/.github/workflows/update-version.yml
deleted file mode 100644
index 33b1b43..0000000
--- a/.github/workflows/update-version.yml
+++ /dev/null
@@ -1,73 +0,0 @@
-name: 'Update Version'
-on:
-  push:
-    branches:
-      - '_update-deps/runtimeverification/rv-nix-tools'
-      - '_update-deps-cron/uv2nix'
-      - '_update-deps-cron/pyproject-build-systems'
-  workflow_dispatch:
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  update-deps:
-    name: 'Update Dependencies'
-    runs-on: ubuntu-latest
-    steps:
-      - name: 'Check out code'
-        uses: actions/checkout@v4
-        with:
-          submodules: recursive
-          token: ${{ secrets.JENKINS_GITHUB_PAT }}
-          fetch-depth: 0
-      - name: 'Configure GitHub user'
-        run: |
-          git config user.name devops
-          git config user.email devops@runtimeverification.com
-      - name: 'Install Python'
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.10'
-      # note: we install the same version of `uv` as used by `uv2nix` in order to match the nix derivation
-      - name: 'Update uv release tag'
-        id: uv_release
-        run: |
-          UV2NIX_VERSION=$(cat deps/uv2nix)
-          UV_VERSION=$(curl -s https://raw.githubusercontent.com/pyproject-nix/uv2nix/$(cat deps/uv2nix)/pkgs/uv-bin/srcs.json | jq -r .version)
-          [[ "$UV_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]
-          echo $UV_VERSION > deps/uv_release
-          git add deps/uv_release && git commit -m "Sync uv version: uv ${UV_VERSION}" || true
-          echo uv_version=$UV_VERSION >> "${GITHUB_OUTPUT}"
-      - name: 'Install uv'
-        uses: astral-sh/setup-uv@v7
-        with:
-          version: ${{ steps.uv_release.outputs.uv_version }}
-      - name: 'Install Nix'
-        uses: cachix/install-nix-action@v31.7.0
-        with:
-          install_url: https://releases.nixos.org/nix/nix-2.32.0/install
-          extra_nix_config: |
-            substituters = http://cache.nixos.org https://hydra.iohk.io
-            trusted-public-keys = cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY= hydra.iohk.io:f/Ea+s+dFdN+3Y/G+FDgSq+a5NEWhJGzdjvKNGv0/EQ=
-            access-tokens = github.com=${{ secrets.GITHUB_TOKEN }}
-      - uses: cachix/cachix-action@v16
-        with:
-          name: k-framework
-          authToken: ${{ secrets.CACHIX_PUBLIC_TOKEN }}
-      - name: 'Update uv files'
-        run: |
-          uv lock --upgrade
-          git add uv.lock && git commit -m "Sync uv lock file" || true
-      - name: 'Update Nix flake inputs'
-        run: |
-          UV2NIX_VERSION=$(cat deps/uv2nix)
-          PYPROJECT_BUILD_SYSTEMS_VERSION=$(cat deps/pyproject-build-systems)
-          RV_NIX_TOOLS_VERSION=$(cat deps/rv-nix-tools)
-          sed -i 's!    uv2nix.url = "github:pyproject-nix/uv2nix/[a-z0-9\.]*"!    uv2nix.url = "github:pyproject-nix/uv2nix/'"${UV2NIX_VERSION}"'"!' flake.nix
-          sed -i 's!    pyproject-build-systems.url = "github:pyproject-nix/build-system-pkgs/[a-z0-9\.]*"!    pyproject-build-systems.url = "github:pyproject-nix/build-system-pkgs/'"${PYPROJECT_BUILD_SYSTEMS_VERSION}"'"!' flake.nix
-          sed -i 's!    rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/[a-z0-9\.]*"!    rv-nix-tools.url = "github:runtimeverification/rv-nix-tools/'"${RV_NIX_TOOLS_VERSION}"'"!' flake.nix
-          nix flake update
-          git add flake.nix flake.lock && git commit -m 'flake.{nix,lock}: update Nix derivations' || true
-      - name: 'Push updates'
-        run: git push