diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8cbb0b..24432ec 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -184,3 +184,6 @@ jobs:
           # 校验工具由镜像提供，缺失时直接失败而非跳过
           command -v shellcheck >/dev/null || { echo "::error::镜像里没有 shellcheck，workflow 检查不完整"; exit 1; }
           "$RUNNER_TEMP/actionlint"
+
+      - name: workflow 安全分析
+        run: pipx run zizmor==1.32.0 --format github .github/workflows
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5c95e10..5742d0a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,7 +11,7 @@ concurrency:
 
 jobs:
   ci:
-    uses: ./.github/workflows/ci.yml
+    uses: ./.github/workflows/ci.yml  # zizmor: ignore[self-repository]
     permissions:
       contents: read
 
@@ -25,6 +25,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Read @version
         id: ver
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000..f91fb48
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,6 @@
+# actions/* 用大版本标签，其余要求哈希。
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "actions/*": ref-pin
diff --git "a/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js" "b/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js"
index 8c1a882..5eb2a0b 100644
--- "a/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js"
+++ "b/\347\275\221\347\233\230\347\233\264\351\223\276\344\270\213\350\275\275\345\212\251\346\211\213.user.js"
@@ -1,7 +1,7 @@
 // ==UserScript==
 // @name              FerryLink
 // @namespace         https://github.com/Wjavan/FerryLink
-// @version           1.6.4
+// @version           1.6.5
 // @author            Wjavan
 // @description       支持百度/阿里/天翼/迅雷/夸克/移动/城通网盘直链下载。支持 HTTP/JSON-RPC/cURL，推送至 IDM/XDown/Aria2/NDM/Motrix/终端。基于油小猴(youxiaohou.com)的网盘直链下载助手修改。
 // @copyright         2026, Wjavan (https://github.com/Wjavan)