diff --git a/.github/workflows/generate-desktop-targets.yml b/.github/workflows/generate-desktop-targets.yml
index 35deca90ee..20deca2569 100644
--- a/.github/workflows/generate-desktop-targets.yml
+++ b/.github/workflows/generate-desktop-targets.yml
@@ -47,6 +47,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Import signing keys
         env:
@@ -116,6 +118,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Generate fleet-desktop.exe
         run: |
@@ -162,6 +166,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Generate fleet-desktop.exe
         run: |
@@ -209,6 +215,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Generate desktop.tar.gz
         run: |
@@ -243,6 +251,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Generate desktop.tar.gz
         run: |
diff --git a/.github/workflows/goreleaser-fleet.yaml b/.github/workflows/goreleaser-fleet.yaml
index fc44171ef5..02fb1271b5 100644
--- a/.github/workflows/goreleaser-fleet.yaml
+++ b/.github/workflows/goreleaser-fleet.yaml
@@ -51,11 +51,15 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Set up Node.js
         uses: actions/setup-node@5e21ff4d9bc1a8cf6de233a3057d20ec6b3fb69d # v3.8.1
         with:
           node-version-file: package.json
+          # Security best practice to disable caching in release/publish workflows
+          package-manager-cache: false
 
       - name: Install JS Dependencies
         run: make deps-js
diff --git a/.github/workflows/goreleaser-orbit.yaml b/.github/workflows/goreleaser-orbit.yaml
index e66a936d2a..bb48c2e2e8 100644
--- a/.github/workflows/goreleaser-orbit.yaml
+++ b/.github/workflows/goreleaser-orbit.yaml
@@ -55,6 +55,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-macos.yml # v2.4.4
@@ -103,6 +105,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Install musl tools
         run: sudo apt update && sudo apt install -y musl-tools
@@ -148,6 +152,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-linux-arm64.yml # v2.4.4
@@ -190,6 +196,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows.yml # v2.4.4
@@ -244,6 +252,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Run GoReleaser
         run: go run github.com/goreleaser/goreleaser/v2@606c0e724fe9b980cd01090d08cbebff63cd0f72 release --verbose --clean --skip=publish -f orbit/goreleaser-windows-arm64.yml # v2.4.4
diff --git a/.github/workflows/goreleaser-snapshot-fleet.yaml b/.github/workflows/goreleaser-snapshot-fleet.yaml
index ebe3ea70ad..997d47ccf2 100644
--- a/.github/workflows/goreleaser-snapshot-fleet.yaml
+++ b/.github/workflows/goreleaser-snapshot-fleet.yaml
@@ -60,6 +60,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: "go.mod"
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       # Set the Node.js version
       - name: Set up Node.js
@@ -67,6 +69,8 @@ jobs:
         with:
           node-version-file: package.json
           check-latest: true
+          # Security best practice to disable caching in release/publish workflows
+          package-manager-cache: false
 
       - name: Install Dependencies
         run: make deps
diff --git a/.github/workflows/publish-go-module.yml b/.github/workflows/publish-go-module.yml
index 6c7a022bf4..b729d6a0c6 100644
--- a/.github/workflows/publish-go-module.yml
+++ b/.github/workflows/publish-go-module.yml
@@ -34,6 +34,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Publish go module
         run: |
diff --git a/.github/workflows/release-fleetctl-docker-deps.yaml b/.github/workflows/release-fleetctl-docker-deps.yaml
index c1307d1e45..558a3b4948 100644
--- a/.github/workflows/release-fleetctl-docker-deps.yaml
+++ b/.github/workflows/release-fleetctl-docker-deps.yaml
@@ -43,6 +43,8 @@ jobs:
         uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
         with:
           go-version-file: 'go.mod'
+          # Security best practice to disable caching in release/publish workflows
+          cache: false
 
       - name: Login to Docker Hub
         uses: docker/login-action@f4ef78c080cd8ba55a85445d5b36e214a81df20a # v2.1.0
diff --git a/.github/zizmor-gate.yml b/.github/zizmor-gate.yml
index fa05eacdf3..92d5be0578 100644
--- a/.github/zizmor-gate.yml
+++ b/.github/zizmor-gate.yml
@@ -14,8 +14,6 @@
 rules:
   artipacked: # 125 findings
     disable: true
-  cache-poisoning: # 16 findings
-    disable: true
   dependabot-cooldown: # 2 findings
     disable: true
   excessive-permissions: # 20 findings