diff --git a/.github/workflows/bc.yml b/.github/workflows/bc.yml
index aae258317..67eefd367 100644
--- a/.github/workflows/bc.yml
+++ b/.github/workflows/bc.yml
@@ -1,17 +1,14 @@
+name: backwards compatibility
+
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - '.github/workflows/bc.yml'
       - 'composer.json'
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - '.github/workflows/bc.yml'
-      - 'composer.json'
-
-name: backwards compatibility
+    paths: *paths
 
 permissions:
   contents: read
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 76789c671..d437e2a82 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -1,3 +1,5 @@
+name: build
+
 on:
   pull_request:
     paths: &paths
@@ -6,12 +8,10 @@ on:
       - '.github/workflows/build.yml'
       - 'composer.json'
       - 'phpunit.xml.dist'
-
   push:
     branches: ['master']
     paths: *paths
 
-name: build
 
 permissions:
   contents: read
diff --git a/.github/workflows/composer-require-checker.yml b/.github/workflows/composer-require-checker.yml
index 29c303fc3..f1e1b0538 100644
--- a/.github/workflows/composer-require-checker.yml
+++ b/.github/workflows/composer-require-checker.yml
@@ -1,20 +1,15 @@
+name: Composer require checker
+
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - '.github/workflows/composer-require-checker.yml'
       - 'composer.json'
       - 'composer-require-checker.json'
-
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - '.github/workflows/composer-require-checker.yml'
-      - 'composer.json'
-      - 'composer-require-checker.json'
-
-name: Composer require checker
+    paths: *paths
 
 permissions:
   contents: read
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 7281baeb0..80ca62c8e 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -1,18 +1,14 @@
+name: mutation test
+
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - '.github/workflows/mutation.yml'
       - 'composer.json'
-
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - '.github/workflows/mutation.yml'
-      - 'composer.json'
-
-name: mutation test
+    paths: *paths
 
 permissions:
   contents: read
@@ -52,12 +48,12 @@ jobs:
 
     steps:
       - name: Checkout.
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           persist-credentials: false
 
       - name: Install PHP with extensions.
-        uses: shivammathur/setup-php@b604ade2a87db23f8871b7182e69ec5e75effb45
+        uses: shivammathur/setup-php@34a5396826718e0013f08e3e639d1c315d5f6b23 # 2.35.0
         with:
           php-version: ${{ matrix.php }}
           extensions: ${{ env.EXTENSIONS }}
@@ -65,7 +61,7 @@ jobs:
           coverage: pcov
 
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f
+        uses: ramsey/composer-install@a8d0d959dab41457692a5e2041bd9b757a119e3f # 3.2.1
 
       - name: Install db.
         uses: yiisoft/actions/install-packages@master
diff --git a/.github/workflows/static.yml b/.github/workflows/static.yml
index 31af80e5d..4724d8b52 100644
--- a/.github/workflows/static.yml
+++ b/.github/workflows/static.yml
@@ -1,20 +1,15 @@
+name: Static analysis
+
 on:
   pull_request:
-    paths:
+    paths: &paths
       - 'src/**'
       - '.github/workflows/static.yml'
       - 'psalm*.xml'
       - 'composer.json'
-
   push:
     branches: ['master']
-    paths:
-      - 'src/**'
-      - '.github/workflows/static.yml'
-      - 'psalm*.xml'
-      - 'composer.json'
-
-name: Static analysis
+    paths: *paths
 
 permissions:
   contents: read
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index dce9aecfe..1e117a71c 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -1,17 +1,17 @@
 name: GitHub Actions Security Analysis with zizmor 🌈
 
 on:
-  push:
-    paths:
-      - '.github/**.yml'
-      - '.github/**.yaml'
   pull_request:
-    paths:
+    paths: &paths
       - '.github/**.yml'
       - '.github/**.yaml'
+  push:
+    branches: [ 'master' ]
+    paths: *paths
 
 permissions:
-  contents: read
+  actions: read # Required by zizmor when reading workflow metadata through the API
+  contents: read # Required to read workflow files
 
 jobs:
   zizmor: