diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 6c48d4a..bc8e8f7 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -7,6 +7,8 @@ on:
     branches: ["main"]
   workflow_dispatch:
 
+permissions: {}
+
 concurrency:
   group: "docs-${{ github.ref }}"
   cancel-in-progress: true
@@ -25,7 +27,7 @@ jobs:
       - name: Setup Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
-          bun-version: latest
+          bun-version: 1.3.14
 
       - name: Setup Pages
         if: github.event_name != 'pull_request'
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 60eba66..2bdfbe1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -12,6 +12,9 @@ jobs:
   zizmor:
     runs-on: ubuntu-latest
     permissions:
+      # Required to upload zizmor's SARIF results to code scanning.
+      security-events: write
+      # Required to check out the repository contents.
       contents: read
     steps:
       - name: Checkout repository
@@ -20,4 +23,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        run: pip install zizmor && zizmor .
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
diff --git a/.gitignore b/.gitignore
index 6240da8..ef06b26 100644
--- a/.gitignore
+++ b/.gitignore
@@ -19,3 +19,6 @@ pnpm-debug.log*
 
 # macOS-specific files
 .DS_Store
+
+# Generated artifacts from exploration and testing.
+/.artifacts/
diff --git a/src/content/docs/guides/getting-started.mdx b/src/content/docs/guides/getting-started.mdx
index bf41b25..1e5f76d 100644
--- a/src/content/docs/guides/getting-started.mdx
+++ b/src/content/docs/guides/getting-started.mdx
@@ -16,7 +16,7 @@ import { Aside } from "@astrojs/starlight/components";
   </TabItem>
   <TabItem label="Linux">
     ```bash
-    os=$(uname -s | tr '[:upper:]' '[:lower:]') && architecture=$(case $(uname -m) in x86_64 | amd64) echo "amd64" ;; aarch64 | arm64 | armv8) echo "arm64" ;; *) echo "amd64" ;; esac) && sudo wget -q https://github.com/ahoy-cli/ahoy/releases/latest/download/ahoy-bin-$os-$architecture -O /usr/local/bin/ahoy && sudo chown $USER /usr/local/bin/ahoy && chmod +x /usr/local/bin/ahoy
+    os=$(uname -s | tr '[:upper:]' '[:lower:]') && architecture=$(case $(uname -m) in (x86_64 | amd64) echo "amd64" ;; (aarch64 | arm64 | armv8*) echo "arm64" ;; (armv7*) echo "armv7" ;; (armv6*) echo "armv6" ;; esac) && { [ -n "$architecture" ] || { echo "Unsupported architecture: $(uname -m)" >&2; false; }; } && sudo wget -q https://github.com/ahoy-cli/ahoy/releases/latest/download/ahoy-bin-$os-$architecture -O /usr/local/bin/ahoy && sudo chown $USER /usr/local/bin/ahoy && chmod +x /usr/local/bin/ahoy
     ```
 
     Or download the [latest release from GitHub](https://github.com/ahoy-cli/ahoy/releases) and place the binary somewhere in your `$PATH`.
@@ -27,6 +27,22 @@ import { Aside } from "@astrojs/starlight/components";
   </TabItem>
 </Tabs>
 
+<Aside type="note" title="Looking for Ahoy v2?">
+  Homebrew has switched to v3, so `brew install ahoy` now installs the latest v3 release. The Linux
+  command above resolves to v3 as well, since it downloads from `/releases/latest/`.
+
+  v3 is intended to be fully backwards compatible with existing v2 `.ahoy.yml` files, so most
+  projects need no changes. If you do still need v2, download it from the
+  [v2.5.0 release page](https://github.com/ahoy-cli/ahoy/releases/tag/v2.5.0) - v2.5.0 is the latest
+  v2 release, and there is no `ahoy@2` Homebrew formula.
+
+  ```bash
+  # Linux amd64. The v2 release also provides ahoy-bin-linux-arm64, ahoy-bin-linux-arm,
+  # ahoy-bin-darwin-amd64 and ahoy-bin-darwin-arm64.
+  sudo wget -q https://github.com/ahoy-cli/ahoy/releases/download/v2.5.0/ahoy-bin-linux-amd64 -O /usr/local/bin/ahoy && sudo chown $USER /usr/local/bin/ahoy && chmod +x /usr/local/bin/ahoy
+  ```
+</Aside>
+
 Verify it's working:
 
 ```bash