diff --git a/.github/workflows/test-go-activity.yaml b/.github/workflows/test-go-activity.yaml
index 5978efbce5..cda7be0295 100644
--- a/.github/workflows/test-go-activity.yaml
+++ b/.github/workflows/test-go-activity.yaml
@@ -58,7 +58,9 @@ jobs:
       cover_pkg: 'github.com/fleetdm/fleet/v4/server/activity/...'
       generate_go: false
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Extended MySQL coverage: only on the nightly cron schedule.
@@ -76,7 +78,9 @@ jobs:
       cover_pkg: 'github.com/fleetdm/fleet/v4/server/activity/...'
       generate_go: false
       is_cron: true
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
 
   # We upload all backend coverage in one step so that we're less likely to end up with a partial coverage report.
   upload-coverage:
diff --git a/.github/workflows/test-go-suite.yaml b/.github/workflows/test-go-suite.yaml
index 66f46fc6b2..deaf6d756b 100644
--- a/.github/workflows/test-go-suite.yaml
+++ b/.github/workflows/test-go-suite.yaml
@@ -29,6 +29,13 @@ on:
         required: false
         type: boolean
         default: false
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT:
+        description: 'GitHub PAT used as NETWORK_TEST_GITHUB_TOKEN for tests that hit the GitHub API.'
+        required: false
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL:
+        description: 'Slack webhook for notifying on scheduled (cron) run failures.'
+        required: false
 
 permissions:
   contents: read
diff --git a/.github/workflows/test-go.yaml b/.github/workflows/test-go.yaml
index d1e38dc799..b5fb52e1e9 100644
--- a/.github/workflows/test-go.yaml
+++ b/.github/workflows/test-go.yaml
@@ -64,7 +64,9 @@ jobs:
     with:
       suite: ${{ matrix.suite }}
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Suites that need MySQL: always-run versions (every push/PR + cron).
@@ -80,7 +82,9 @@ jobs:
       suite: ${{ matrix.suite }}
       mysql: ${{ matrix.mysql }}
       is_cron: ${{ github.event_name == 'schedule' }}
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ github.event_name == 'schedule' && secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL || '' }}
 
   # ──────────────────────────────────────────────────────────────────────────
   # Extended MySQL coverage: only on the nightly cron schedule.
@@ -97,7 +101,9 @@ jobs:
       suite: ${{ matrix.suite }}
       mysql: ${{ matrix.mysql }}
       is_cron: true
-    secrets: inherit
+    secrets:
+      FLEET_RELEASE_GITHUB_PAT: ${{ secrets.FLEET_RELEASE_GITHUB_PAT }}
+      SLACK_G_HELP_ENGINEERING_WEBHOOK_URL: ${{ secrets.SLACK_G_HELP_ENGINEERING_WEBHOOK_URL }}
 
   # Based on https://github.com/micromdm/nanomdm/blob/main/.github/workflows/on-push-pr.yml#L87
   test-go-nanomdm:
diff --git a/.github/zizmor-gate.yml b/.github/zizmor-gate.yml
index 92d5be0578..77b8596300 100644
--- a/.github/zizmor-gate.yml
+++ b/.github/zizmor-gate.yml
@@ -12,11 +12,9 @@
 # .github/zizmor.yml, so a plain `zizmor .` run still reports the full backlog locally.
 
 rules:
-  artipacked: # 125 findings
+  artipacked: # 112 findings
     disable: true
-  dependabot-cooldown: # 2 findings
-    disable: true
-  excessive-permissions: # 20 findings
+  excessive-permissions: # 6 findings
     disable: true
   known-vulnerable-actions: # 418 findings (online audit)
     disable: true
@@ -24,9 +22,5 @@ rules:
     disable: true
   ref-version-mismatch: # 44 findings (online audit)
     disable: true
-  secrets-inherit: # 5 findings
-    disable: true
   template-injection: # 234 findings
     disable: true
-  unpinned-uses: # 31 findings
-    disable: true