diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
new file mode 100644
index 00000000..b594dcbd
--- /dev/null
+++ b/.github/actionlint.yaml
@@ -0,0 +1,10 @@
+# actionlint's rules for this repository. See https://github.com/rhysd/actionlint/blob/main/docs/config.md
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # GitHub's self-repository `uses: $/...` syntax (July 2026) is what zizmor's
+      # self-repository audit asks for in place of `./...`, and what our reusable-workflow
+      # calls use. actionlint 1.7.12 predates it and has no release that knows it
+      # (rhysd/actionlint#711); drop this once one does. The ignore names the exact calls,
+      # so a new `$/` call is a deliberate edit here rather than a silent pass.
+      - 'reusable workflow call "\$/\.github/workflows/(security|headless-probe-composition)\.yml" at "uses" is not following the format'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7fa82203..661c5654 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ permissions: {}
 jobs:
   security:
     name: Security scan
-    uses: ./.github/workflows/security.yml
+    uses: $/.github/workflows/security.yml
     permissions:
       contents: read
       security-events: write
@@ -31,7 +31,7 @@ jobs:
   # actions/checkout inside the reusable workflow has no repository access.
   headless-probe:
     name: Headless keyring probe
-    uses: ./.github/workflows/headless-probe-composition.yml
+    uses: $/.github/workflows/headless-probe-composition.yml
     permissions:
       contents: read
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8ad91f8b..98b2def3 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -93,13 +93,13 @@ jobs:
         uses: rhysd/actionlint@914e7df21a07ef503a81201c76d2b11c789d3fca # v1.7.12
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           # The action resolves `version` (default "latest") through the digest
           # map checked in at its pinned SHA, so this stays stable either way —
           # the explicit pin keeps the release from shifting when the action SHA
           # is bumped, and matches the .mise.toml zizmor pin for local parity.
-          version: "1.29.0"
+          version: "1.30.0"
           advanced-security: false
 
   security:
diff --git a/.mise.toml b/.mise.toml
index b8f1e97e..f1ac9ee0 100644
--- a/.mise.toml
+++ b/.mise.toml
@@ -12,4 +12,4 @@ shellcheck = "0.11.0"
 powershell = "7.6.5"
 # Keep in sync with the zizmor-action `version:` input in
 # .github/workflows/test.yml so local bin/ci runs the same release CI does.
-zizmor = "1.29.0"
+zizmor = "1.30.0"