diff --git a/.github/workflows/audit-gha-workflows.yml b/.github/workflows/audit-gha-workflows.yml
index abd5cf3..30e2d60 100644
--- a/.github/workflows/audit-gha-workflows.yml
+++ b/.github/workflows/audit-gha-workflows.yml
@@ -21,6 +21,35 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          if [ -d .github ]; then
-            zizmor .github --gh-token "${GITHUB_TOKEN}" --min-severity medium
+          if [ ! -d .github ]; then
+            exit 0
           fi
+          if [[ "$GITHUB_REPOSITORY" != SocketDev/depscan || ! -f .github/zizmor-patches.yml ]]; then
+            zizmor .github --gh-token "$GITHUB_TOKEN" --min-severity medium
+            exit 0
+          fi
+
+          audit_dir=$(mktemp -d)
+          trap 'rm -rf "$audit_dir"' EXIT
+          cp -R .github "$audit_dir/.github"
+          for config in zizmor.yml zizmor.yaml; do
+            if [ -f "$config" ]; then
+              cp "$config" "$audit_dir/$config"
+            fi
+          done
+          patch_workflows=()
+          for workflow in deploy-patches-staging.yaml deploy-patches-prod.yaml patches-compatibility.yaml; do
+            workflow=".github/workflows/$workflow"
+            if [ -f "$workflow" ]; then
+              patch_workflows+=("$workflow")
+              rm "$audit_dir/$workflow"
+            fi
+          done
+
+          status=0
+          zizmor "$audit_dir/.github" --gh-token "$GITHUB_TOKEN" --min-severity medium || status=$?
+          if [ "${#patch_workflows[@]}" -gt 0 ]; then
+            zizmor "${patch_workflows[@]}" --config .github/zizmor-patches.yml \
+              --gh-token "$GITHUB_TOKEN" --min-severity medium || status=$?
+          fi
+          exit "$status"