diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml
index 9d3127c389..040caea669 100644
--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -21,10 +21,6 @@ on:
       - closed
       - labeled
 
-permissions:
-  contents: write
-  pull-requests: write
-
 # Prevent duplicate runs for the same PR when both 'closed' and 'labeled'
 # fire in quick succession.
 concurrency:
@@ -33,6 +29,8 @@ concurrency:
 jobs:
   detect:
     name: Detect target branches
+    permissions:
+      contents: read
     if: >
       github.event.pull_request.merged == true &&
       contains(github.event.pull_request.labels.*.name, 'backport')
@@ -44,6 +42,7 @@ jobs:
         with:
           # Need all refs to discover release branches.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Find latest release branches
         id: find
@@ -73,6 +72,9 @@ jobs:
   backport:
     name: "Backport to ${{ matrix.branch }}"
     needs: detect
+    permissions:
+      contents: write
+      pull-requests: write
     if: needs.detect.outputs.branches != '[]'
     runs-on: ubuntu-latest
     strategy:
@@ -85,11 +87,13 @@ jobs:
       PR_URL: ${{ github.event.pull_request.html_url }}
       MERGE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
       SENDER: ${{ github.event.sender.login }}
+      BRANCH: ${{ matrix.branch }}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           # Full history required for cherry-pick.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Cherry-pick and open PR
         env:
@@ -97,7 +101,11 @@ jobs:
         run: |
           set -euo pipefail
 
-          RELEASE_VERSION="${{ matrix.branch }}"
+          # Configure git to authenticate pushes with the job token
+          # since persist-credentials is disabled on checkout.
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+
+          RELEASE_VERSION="$BRANCH"
           # Strip the release/ prefix for naming.
           VERSION="${RELEASE_VERSION#release/}"
           BACKPORT_BRANCH="backport/${PR_NUMBER}-to-${VERSION}"
diff --git a/.github/workflows/cherry-pick.yaml b/.github/workflows/cherry-pick.yaml
index a8d84e0329..98abd79382 100644
--- a/.github/workflows/cherry-pick.yaml
+++ b/.github/workflows/cherry-pick.yaml
@@ -48,6 +48,7 @@ jobs:
         with:
           # Full history required for cherry-pick and branch discovery.
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Cherry-pick and open PR
         env:
@@ -55,6 +56,10 @@ jobs:
         run: |
           set -euo pipefail
 
+          # Configure git to authenticate pushes with the job token
+          # since persist-credentials is disabled on checkout.
+          git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+
           # Find the latest release branch matching the exact release/2.X
           # pattern (no suffixes like release/2.31_hotfix).
           RELEASE_BRANCH=$(
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index f1923e9be3..cfb40c9c9d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -105,7 +105,7 @@ jobs:
               - "scripts/helm.sh"
             ci:
               - ".github/actions/**"
-              - ".github/workflows/ci.yaml"
+              - ".github/workflows/**"
             offlinedocs:
               - "offlinedocs/**"
             tailnet-integration:
@@ -246,8 +246,7 @@ jobs:
     needs: changes
     # Only run this job if changes to CI workflow files are detected. This job
     # can flake as it reaches out to GitHub to check referenced actions.
-    # TODO(#24323): Re-enable once pre-existing zizmor findings are fixed.
-    if: false # needs.changes.outputs.ci == 'true'
+    if: needs.changes.outputs.ci == 'true'
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-latest' }}
     steps:
       - name: Harden Runner
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index e125592cfd..47a1cea3e5 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,4 +1,12 @@
 rules:
   cache-poisoning:
     ignore:
-      - "ci.yaml:184"
+      - "ci.yaml:187"
+  dangerous-triggers:
+    ignore:
+      # Both workflows use pull_request_target intentionally: they need
+      # write access to create backport/cherry-pick branches and PRs.
+      # They only run after merge (merged == true) and do not check out
+      # or execute untrusted PR code.
+      - "backport.yaml"
+      - "cherry-pick.yaml"