diff --git a/.github/workflows/assigned.yaml b/.github/workflows/assigned.yaml
index f365067ce..5a22117b6 100644
--- a/.github/workflows/assigned.yaml
+++ b/.github/workflows/assigned.yaml
@@ -3,11 +3,22 @@ name: Issue Assigned
 on:
   issues:
     types: [assigned]
+permissions: {}  # let's not use any permissions we don't need here
 jobs:
   send-mattermost-message:
     runs-on: ubuntu-latest
     steps:
-    - uses: mattermost/action-mattermost-notify@master
+    # issue triggers in github actions can be dangerous like
+    # pull_request_target because they run with additional privileges in an
+    # environment containing values that can be controlled by an attacker.
+    # because of this, please take extra caution when modifying the steps taken
+    # by this workflow. for additional information, see
+    # https://github.com/certbot/certbot/pull/10490
+    #
+    # we pin this action to a version tested and audited by certbot's
+    # maintainers for extra security. the full hash is used as doing so is
+    # recommended by zizmor
+    - uses: mattermost/action-mattermost-notify@b7d118e440bf2749cd18a4a8c88e7092e696257a
       with:
         MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_ASSIGN_WEBHOOK }}
         TEXT: >
diff --git a/.github/workflows/merged.yaml b/.github/workflows/merged.yaml
index 7c9277585..9d46ce264 100644
--- a/.github/workflows/merged.yaml
+++ b/.github/workflows/merged.yaml
@@ -4,13 +4,23 @@ on:
   pull_request_target:
     types:
       - closed
-
+permissions: {}  # let's not use any permissions we don't need here
 jobs:
   if_merged:
     if: github.event.pull_request.merged == true
     runs-on: ubuntu-latest
     steps:
-    - uses: mattermost/action-mattermost-notify@master
+    # github actions workflows triggered by pull_request_target can be
+    # dangerous because they run with additional privileges in an environment
+    # containing values that can be controlled by an attacker. because of
+    # this, please take extra caution when modifying the steps taken by this
+    # workflow. for additional information, see
+    # https://github.com/certbot/certbot/pull/10490
+    #
+    # we pin this action to a version tested and audited by certbot's
+    # maintainers for extra security. the full hash is used as doing so is
+    # recommended by zizmor
+    - uses: mattermost/action-mattermost-notify@b7d118e440bf2749cd18a4a8c88e7092e696257a
       with:
         MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_MERGE_WEBHOOK }}
         TEXT: >
diff --git a/.github/workflows/notify_weekly.yaml b/.github/workflows/notify_weekly.yaml
index cd9377433..29b3fb587 100644
--- a/.github/workflows/notify_weekly.yaml
+++ b/.github/workflows/notify_weekly.yaml
@@ -5,6 +5,7 @@ on:
     # Every week on Thursday @ 10:00
     - cron: "0 10 * * 4"
   workflow_dispatch:
+permissions: {}  # let's not use any permissions we don't need here
 jobs:
   send-mattermost-message:
     runs-on: ubuntu-latest
@@ -15,7 +16,10 @@ jobs:
         DATE=$(date --date="7 days ago" +"%Y-%m-%d")
         echo "ASSIGNED_PRS=https://github.com/pulls?q=is%3Apr+is%3Aopen+updated%3A%3E%3D${DATE}+assignee%3A*+user%3Acertbot" >> $GITHUB_ENV
         echo "UPDATED_URL=https://github.com/issues?q=is%3Aissue+is%3Aopen+sort%3Acomments-desc+updated%3A%3E%3D${DATE}+user%3Acertbot" >> $GITHUB_ENV
-    - uses: mattermost/action-mattermost-notify@master
+    # we pin this action to a version tested and audited by certbot's
+    # maintainers for extra security. the full hash is used as doing so is
+    # recommended by zizmor
+    - uses: mattermost/action-mattermost-notify@b7d118e440bf2749cd18a4a8c88e7092e696257a
       with:
         MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_WEBHOOK_URL }}
         MATTERMOST_CHANNEL: private-certbot
diff --git a/.github/workflows/review_requested.yaml b/.github/workflows/review_requested.yaml
index 1d71acba7..162c1c485 100644
--- a/.github/workflows/review_requested.yaml
+++ b/.github/workflows/review_requested.yaml
@@ -3,13 +3,24 @@ name: Review Requested
 on:
   pull_request_target:
     types: [review_requested]
+permissions: {}
 jobs:
   send-mattermost-message:
     # Don't notify for the interim step of certbot/eff-devs being assigned
     if: ${{ github.event.requested_reviewer.login != ''}}
     runs-on: ubuntu-latest
     steps:
-    - uses: mattermost/action-mattermost-notify@master
+    # github actions workflows triggered by pull_request_target can be
+    # dangerous because they run with additional privileges in an environment
+    # containing values that can be controlled by an attacker. because of
+    # this, please take extra caution when modifying the steps taken by this
+    # workflow. for additional information, see
+    # https://github.com/certbot/certbot/pull/10490
+    #
+    # we pin this action to a version tested and audited by certbot's
+    # maintainers for extra security. the full hash is used as doing so is
+    # recommended by zizmor
+    - uses: mattermost/action-mattermost-notify@b7d118e440bf2749cd18a4a8c88e7092e696257a
       with:
         MATTERMOST_WEBHOOK_URL: ${{ secrets.MATTERMOST_ASSIGN_WEBHOOK }}
         TEXT: >