diff --git a/.github/workflows/agent-scan.yml b/.github/workflows/agent-scan.yml
index 7ab3153..e43bb89 100644
--- a/.github/workflows/agent-scan.yml
+++ b/.github/workflows/agent-scan.yml
@@ -1,6 +1,7 @@
 name: agent-scan
 
 on:
+  # zizmor: ignore[dangerous-triggers] - no PR content is checked out or executed; DO NOT add actions/checkout here
   pull_request_target:
     types:
       - closed