diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 78d5770d7..a40c0e90d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,7 @@ jobs:
   release:
     name: Create release
     runs-on: ubuntu-latest
+    environment: release
 
     permissions:
       # This is needed for https://github.com/stefanzweifel/git-auto-commit-action.
@@ -138,6 +139,7 @@ jobs:
     name: Publish Docker images
     needs: release
     runs-on: ubuntu-latest
+    environment: dockerhub
 
     permissions: {}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bcec038c2..20dcdbe41 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -22,6 +22,7 @@ jobs:
   # CI tests with matrix
   ci-tests:
     runs-on: ubuntu-latest
+    environment: vuforia
     strategy:
       fail-fast: false
       matrix:
diff --git a/pyproject.toml b/pyproject.toml
index 9404214e6..c5a8dcfda 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -108,7 +108,7 @@ optional-dependencies.dev = [
     "vws-test-fixtures==2023.3.5",
     "vws-web-tools==2026.2.22.1",
     "yamlfix==1.19.1",
-    "zizmor==1.22.0",
+    "zizmor==1.23.1",
 ]
 optional-dependencies.release = [ "check-wheel-contents==0.6.3" ]
 urls.Documentation = "https://vws-python.github.io/vws-python-mock/"
diff --git a/zizmor.yml b/zizmor.yml
index f63e179d2..fab119cb0 100644
--- a/zizmor.yml
+++ b/zizmor.yml
@@ -8,5 +8,7 @@ rules:
     disable: true
   dependabot-cooldown:
     disable: true
+  superfluous-actions:
+    disable: true
   template-injection:
     disable: true