diff --git a/.github/workflows/builder.yml b/.github/workflows/builder.yml
index 7db0d0e2132..60cb6659164 100644
--- a/.github/workflows/builder.yml
+++ b/.github/workflows/builder.yml
@@ -72,7 +72,7 @@ jobs:
       - name: Download Translations
         run: python3 -m script.translations download
         env:
-          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }}
+          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }} # zizmor: ignore[secrets-outside-env]
 
       - name: Archive translations
         shell: bash
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3ec04d445bc..cc80dba740c 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1400,7 +1400,7 @@ jobs:
         with:
           fail_ci_if_error: true
           flags: full-suite
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
 
   pytest-partial:
     name: Run tests Python ${{ matrix.python-version }} (${{ matrix.group }})
@@ -1570,7 +1570,7 @@ jobs:
         uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
         with:
           fail_ci_if_error: true
-          token: ${{ secrets.CODECOV_TOKEN }}
+          token: ${{ secrets.CODECOV_TOKEN }} # zizmor: ignore[secrets-outside-env]
 
   upload-test-results:
     name: Upload test results to Codecov
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 95ae4c4a314..f8b8816e8f1 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -58,8 +58,8 @@ jobs:
         # v1.7.0
         uses: tibdex/github-app-token@3beb63f4bd073e61482598c45c71c1019b59b73a
         with:
-          app_id: ${{ secrets.ISSUE_TRIAGE_APP_ID }}
-          private_key: ${{ secrets.ISSUE_TRIAGE_APP_PEM }}
+          app_id: ${{ secrets.ISSUE_TRIAGE_APP_ID }} # zizmor: ignore[secrets-outside-env]
+          private_key: ${{ secrets.ISSUE_TRIAGE_APP_PEM }} # zizmor: ignore[secrets-outside-env]
 
       # The 90 day stale policy for issues
       # Used for:
diff --git a/.github/workflows/translations.yml b/.github/workflows/translations.yml
index f5e0119b234..8d9d4f2e2da 100644
--- a/.github/workflows/translations.yml
+++ b/.github/workflows/translations.yml
@@ -33,6 +33,6 @@ jobs:
 
       - name: Upload Translations
         env:
-          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }}
+          LOKALISE_TOKEN: ${{ secrets.LOKALISE_TOKEN }} # zizmor: ignore[secrets-outside-env]
         run: |
           python3 -m script.translations upload
diff --git a/.github/workflows/wheels.yml b/.github/workflows/wheels.yml
index c3f3ea0473c..e95c7ed7e03 100644
--- a/.github/workflows/wheels.yml
+++ b/.github/workflows/wheels.yml
@@ -142,7 +142,7 @@ jobs:
           abi: ${{ matrix.abi }}
           tag: musllinux_1_2
           arch: ${{ matrix.arch }}
-          wheels-key: ${{ secrets.WHEELS_KEY }}
+          wheels-key: ${{ secrets.WHEELS_KEY }} # zizmor: ignore[secrets-outside-env]
           env-file: true
           apk: "libffi-dev;openssl-dev;yaml-dev;nasm;zlib-ng-dev"
           skip-binary: aiohttp;multidict;propcache;yarl;SQLAlchemy
@@ -200,7 +200,7 @@ jobs:
           abi: ${{ matrix.abi }}
           tag: musllinux_1_2
           arch: ${{ matrix.arch }}
-          wheels-key: ${{ secrets.WHEELS_KEY }}
+          wheels-key: ${{ secrets.WHEELS_KEY }} # zizmor: ignore[secrets-outside-env]
           env-file: true
           apk: "bluez-dev;libffi-dev;openssl-dev;glib-dev;eudev-dev;libxml2-dev;libxslt-dev;libpng-dev;libjpeg-turbo-dev;tiff-dev;gmp-dev;mpfr-dev;mpc1-dev;ffmpeg-dev;yaml-dev;openblas-dev;fftw-dev;lapack-dev;gfortran;blas-dev;eigen-dev;freetype-dev;glew-dev;harfbuzz-dev;hdf5-dev;libdc1394-dev;libtbb-dev;mesa-dev;openexr-dev;openjpeg-dev;uchardet-dev;nasm;zlib-ng-dev"
           skip-binary: aiohttp;charset-normalizer;grpcio;multidict;SQLAlchemy;propcache;protobuf;pymicro-vad;yarl
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 79f9f5fd540..018b971cbe2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -18,7 +18,7 @@ repos:
         exclude_types: [csv, json, html]
         exclude: ^tests/fixtures/|homeassistant/generated/|tests/components/.*/snapshots/
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
-    rev: v1.22.0
+    rev: v1.23.1
     hooks:
       - id: zizmor
         args:
diff --git a/requirements_test_pre_commit.txt b/requirements_test_pre_commit.txt
index 4ea4d8f07f2..30ce21ba332 100644
--- a/requirements_test_pre_commit.txt
+++ b/requirements_test_pre_commit.txt
@@ -3,4 +3,4 @@
 codespell==2.4.1
 ruff==0.15.1
 yamllint==1.37.1
-zizmor==1.22.0
+zizmor==1.23.1