diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 6a014daa2a..5cd958d90f 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@f9597c869b2e67095f9b527070297a13a6efe928 # v0.7.0
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           # Fork PRs run with a read-only GITHUB_TOKEN, so SARIF upload to
           # Code scanning would fail. In that case, run zizmor anyway and