diff --git a/.github/requirements-ci.txt b/.github/requirements-ci.txt
index 3ff91367de..7ba550faf3 100644
--- a/.github/requirements-ci.txt
+++ b/.github/requirements-ci.txt
@@ -156,5 +156,15 @@ ruff==0.16.5 \
 # hash is the manylinux_2_28_x86_64 build the ubuntu-24.04 runner resolves
 # (that image ships glibc 2.39). A host outside that platform cannot install
 # from this file under --require-hashes.
-zizmor==1.27.0 \
-    --hash=sha256:afb28123882d2b8248f1e480bf6cc6d1af102e0d3fbe22a40f7f795b1aa9d435
+zizmor==1.30.0 \
+    --hash=sha256:0148b61f6315ad363ae748f838e8ed81e1cfb3ade6bbe480e7516e4fba630b82 \
+    --hash=sha256:0e69a86290dff4c41b51c381a27029b5dc2b748c0510a9a333b18f862ea1bc68 \
+    --hash=sha256:1f15ed62ff34ad7875427384b03a2f72995d9ab8ddcb50dc141b25763de3aaa2 \
+    --hash=sha256:39f15155db3e4af9bb5cf125a236c67fd84ddd3174f60b4111b27c691b337e00 \
+    --hash=sha256:51c96204572b9f96b940806a371a9c57c8cff30cf93d3bd73c2febe483f942df \
+    --hash=sha256:7569a58319fb270c14a64663a6565929035f26f6f6d13059314f796e988129eb \
+    --hash=sha256:9a17ac3bb043afbbd9d3c8b6f309fa5b319c6a32e3259fbaf050f6fcd3d0a9cd \
+    --hash=sha256:9c08a7c34b33ed6f9a3a3d28fcf8c64e3e078c53c51bc9ce05c32ec3ba7feae9 \
+    --hash=sha256:baa02978518248bf9f011e6ceca7b7c5efb5b893810cd4954e01785e1b68f959 \
+    --hash=sha256:ca321b5b1cb85d08ac0c3c86275bfd5a6b5564c176437e3b41e10bd1e4463296 \
+    --hash=sha256:e4193537785dd07177227e4695871ffae1d7fe3f6043c217498445e71b477bc1