diff --git a/.github/workflows/specification-version-check.yml b/.github/workflows/specification-version-check.yml
index aa8c1e685d..8a372cbe13 100644
--- a/.github/workflows/specification-version-check.yml
+++ b/.github/workflows/specification-version-check.yml
@@ -33,6 +33,6 @@ jobs:
       contents: read
       issues: write
     needs: get-supported-tuf-version
-    uses: theupdateframework/specification/.github/workflows/check-latest-spec-version.yml@master
+    uses: theupdateframework/specification/.github/workflows/check-latest-spec-version.yml@master # zizmor: ignore[unpinned-uses]
     with:
       tuf-version: ${{needs.get-supported-tuf-version.outputs.version}}
diff --git a/requirements/lint.txt b/requirements/lint.txt
index dcbc97b83a..2119b97831 100644
--- a/requirements/lint.txt
+++ b/requirements/lint.txt
@@ -6,9 +6,9 @@
 # Lint tools
 # (We are not so interested in the specific versions of the tools: the versions
 # are pinned to prevent unexpected linting failures when tools update)
-ruff==0.14.11
+ruff==0.14.13
 mypy==1.19.1
-zizmor==1.20.0
+zizmor==1.22.0
 
 # Required for type stubs
 freezegun==1.5.5