diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 000000000000..f1b71580ebca
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,12 @@
+# This file defines the ignore rules for zizmor.
+#
+# For rules that contain a high number of false positives, prefer listing them here
+# instead of adding ignore comments. Note that zizmor cannot ignore by line-within-a-string, so
+# there are some ignore items that encompass multiple problems within one `run` block. An issue
+# tracking this is at https://github.com/woodruffw/zizmor/issues/648.
+#
+# For more info, see the documentation: https://woodruffw.github.io/zizmor/usage/#ignoring-results
+
+rules:
+  dangerous-triggers:
+    disable: true
diff --git a/ci/default.nix b/ci/default.nix
index 7b7424f4f5be..972c679a1492 100644
--- a/ci/default.nix
+++ b/ci/default.nix
@@ -136,6 +136,8 @@ let
             [ "--config=${config}" ];
           includes = [ "*.md" ];
         };
+
+        programs.zizmor.enable = true;
       };
       fs = pkgs.lib.fileset;
       nixFilesSrc = fs.toSource {