diff --git a/.github/workflows/code_coverage.yml b/.github/workflows/code_coverage.yml
index d6d8e9acf..11f507af1 100644
--- a/.github/workflows/code_coverage.yml
+++ b/.github/workflows/code_coverage.yml
@@ -16,20 +16,18 @@ jobs:
       - name: Install lcov tools
         run: sudo apt-get install lcov -y
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v1
         with:
-            toolchain: nightly
+            toolchain: nightly-2025-11-27
             override: true
-            profile: minimal
+            cache: true
             components: llvm-tools-preview
-      - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.7.8
       - name: Install cargo-llvm-cov
         run: if [[ ! -e ~/.cargo/bin/cargo-llvm-cov ]]; then cargo install cargo-llvm-cov; fi
       - name: Make coverage directory
         run: mkdir coverage
       - name: Test and report coverage
-        run: cargo +nightly llvm-cov -q --doctests --branch --all --ignore-filename-regex "(example*|crates/testenv/*)" --all-features --lcov --output-path ./coverage/lcov.info
+        run: cargo llvm-cov -q --doctests --branch --all --ignore-filename-regex "(example*|crates/testenv/*)" --all-features --lcov --output-path ./coverage/lcov.info
       - name: Generate HTML coverage report
         run: genhtml -o coverage-report.html --ignore-errors unmapped ./coverage/lcov.info
       - name: Coveralls upload
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000..956f30dc0
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,7 @@
+# Zizmor config
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Allow pin by ref/tag
+        actions-rust-lang/setup-rust-toolchain: ref-pin