diff --git a/.github/zizmor/requirements.txt b/.github/zizmor/requirements.txt
index 3f493a9..6833f04 100644
--- a/.github/zizmor/requirements.txt
+++ b/.github/zizmor/requirements.txt
@@ -1,3 +1,3 @@
 # Pinned so zizmor findings stay reproducible across CI runs. Dependabot
 # (pip ecosystem, see .github/dependabot.yml) bumps this automatically.
-zizmor==1.25.2
+zizmor==1.28.0