diff --git a/.github/.cspell/project-dictionary.txt b/.github/.cspell/project-dictionary.txt
index 27cbf9f6..0cf8132b 100644
--- a/.github/.cspell/project-dictionary.txt
+++ b/.github/.cspell/project-dictionary.txt
@@ -32,3 +32,4 @@ watchexec
 worktree
 xbuild
 xscale
+zizmor
diff --git a/TOOLS.md b/TOOLS.md
index 3cf18b57..2913a49b 100644
--- a/TOOLS.md
+++ b/TOOLS.md
@@ -73,6 +73,7 @@ See the [Supported tools section in README.md](README.md#supported-tools) for ho
 | [**wasmtime**](https://github.com/bytecodealliance/wasmtime) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/bytecodealliance/wasmtime/releases) | Linux, macOS, Windows | [Apache-2.0 WITH LLVM-exception](https://github.com/bytecodealliance/wasmtime/blob/main/LICENSE) |
 | [**xbuild**](https://github.com/rust-mobile/xbuild) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/rust-mobile/xbuild/releases) | Linux, macOS, Windows | [Apache-2.0 OR MIT](https://github.com/rust-mobile/xbuild/blob/v0.2.0/xbuild/Cargo.toml#L7) |
 | [**xh**](https://github.com/ducaale/xh) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/ducaale/xh/releases) | Linux, macOS, Windows | [MIT](https://github.com/ducaale/xh/blob/master/LICENSE) |
+| [**zizmor**](https://github.com/zizmorcore/zizmor) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/zizmorcore/zizmor/releases) | Linux, macOS, Windows | [MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE) |
 | [**zola**](https://github.com/getzola/zola) | `$CARGO_HOME/bin` | [GitHub Releases](https://github.com/getzola/zola/releases) | Linux, macOS, Windows | [MIT](https://github.com/getzola/zola/blob/master/LICENSE) |
 
 [cargo-binstall]: https://github.com/cargo-bins/cargo-binstall
diff --git a/manifests/zizmor.json b/manifests/zizmor.json
new file mode 100644
index 00000000..5872bf76
--- /dev/null
+++ b/manifests/zizmor.json
@@ -0,0 +1,52 @@
+{
+  "rust_crate": "zizmor",
+  "template": {
+    "x86_64_linux_gnu": {
+      "url": "https://github.com/zizmorcore/zizmor/releases/download/v${version}/zizmor-x86_64-unknown-linux-gnu.tar.gz"
+    },
+    "x86_64_macos": {
+      "url": "https://github.com/zizmorcore/zizmor/releases/download/v${version}/zizmor-x86_64-apple-darwin.tar.gz"
+    },
+    "x86_64_windows": {
+      "url": "https://github.com/zizmorcore/zizmor/releases/download/v${version}/zizmor-x86_64-pc-windows-msvc.zip"
+    },
+    "aarch64_linux_gnu": {
+      "url": "https://github.com/zizmorcore/zizmor/releases/download/v${version}/zizmor-aarch64-unknown-linux-gnu.tar.gz"
+    },
+    "aarch64_macos": {
+      "url": "https://github.com/zizmorcore/zizmor/releases/download/v${version}/zizmor-aarch64-apple-darwin.tar.gz"
+    }
+  },
+  "license_markdown": "[MIT](https://github.com/zizmorcore/zizmor/blob/main/LICENSE)",
+  "latest": {
+    "version": "1.9.0"
+  },
+  "1": {
+    "version": "1.9.0"
+  },
+  "1.9": {
+    "version": "1.9.0"
+  },
+  "1.9.0": {
+    "x86_64_linux_gnu": {
+      "etag": "0x8DD9FC256DC942D",
+      "checksum": "7ec3b5d0796324245eab6acf9223cc04b01ab5357e32bc89f5f42972082bb955"
+    },
+    "x86_64_macos": {
+      "etag": "0x8DD9FC25670B70E",
+      "checksum": "bcdded3b6692a7030d59bfff58c20548b2ac9ec9ac34ed975645bd7cac6d3cb4"
+    },
+    "x86_64_windows": {
+      "etag": "0x8DD9FC2566AA363",
+      "checksum": "8012a860749c7ebb76a4bed1c039759d05fd898b1e5b41eedb540583833ca4d1"
+    },
+    "aarch64_linux_gnu": {
+      "etag": "0x8DD9FC2566FF49D",
+      "checksum": "4dec6688af284fff10d84846771999df00085d107e8cb8dc8d6a1c6cdc4a9640"
+    },
+    "aarch64_macos": {
+      "etag": "0x8DD9FC2566C284B",
+      "checksum": "dd9233c82889e37c271fd9f615aeed670c4c3bdac014fb58ce64552468ac3afb"
+    }
+  }
+}
diff --git a/tools/ci/tool-list.sh b/tools/ci/tool-list.sh
index 2b468279..827cf9f4 100755
--- a/tools/ci/tool-list.sh
+++ b/tools/ci/tool-list.sh
@@ -7,7 +7,11 @@ cd -- "$(dirname -- "$0")"/../..
 
 # They don't provide prebuilt binaries for musl or old glibc host.
 # version `GLIBC_2.35' not found
+glibc_pre_2_39_incompat=(
+  zizmor
+)
 glibc_pre_2_35_incompat=(
+  "${glibc_pre_2_39_incompat[@]}"
   zola
 )
 # version `GLIBC_2.34' not found
@@ -71,33 +75,38 @@ case "$(uname -s)" in
       incompat_tools+=("${musl_incompat[@]}")
     else
       host_glibc_version=$(grep -E "GLIBC|GNU libc" <<<"${ldd_version}" | sed "s/.* //g")
-      higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.35"$'\n'"${host_glibc_version}" | tail -1)
+      higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.39"$'\n'"${host_glibc_version}" | tail -1)
       if [[ "${higher_glibc_version}" != "${host_glibc_version}" ]]; then
-        higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.34"$'\n'"${host_glibc_version}" | tail -1)
+        higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.35"$'\n'"${host_glibc_version}" | tail -1)
         if [[ "${higher_glibc_version}" != "${host_glibc_version}" ]]; then
-          higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.31"$'\n'"${host_glibc_version}" | tail -1)
+          higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.34"$'\n'"${host_glibc_version}" | tail -1)
           if [[ "${higher_glibc_version}" != "${host_glibc_version}" ]]; then
-            higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.28"$'\n'"${host_glibc_version}" | tail -1)
+            higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.31"$'\n'"${host_glibc_version}" | tail -1)
             if [[ "${higher_glibc_version}" != "${host_glibc_version}" ]]; then
-              higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.27"$'\n'"${host_glibc_version}" | tail -1)
+              higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.28"$'\n'"${host_glibc_version}" | tail -1)
               if [[ "${higher_glibc_version}" != "${host_glibc_version}" ]]; then
-                higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.17"$'\n'"${host_glibc_version}" | tail -1)
+                higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.27"$'\n'"${host_glibc_version}" | tail -1)
                 if [[ "${higher_glibc_version}" != "${host_glibc_version}" ]]; then
-                  incompat_tools+=("${glibc_pre_2_17_incompat[@]}")
+                  higher_glibc_version=$(LC_ALL=C sort -Vu <<<"2.17"$'\n'"${host_glibc_version}" | tail -1)
+                  if [[ "${higher_glibc_version}" != "${host_glibc_version}" ]]; then
+                    incompat_tools+=("${glibc_pre_2_17_incompat[@]}")
+                  else
+                    incompat_tools+=("${glibc_pre_2_27_incompat[@]}")
+                  fi
                 else
-                  incompat_tools+=("${glibc_pre_2_27_incompat[@]}")
+                  incompat_tools+=("${glibc_pre_2_28_incompat[@]}")
                 fi
               else
-                incompat_tools+=("${glibc_pre_2_28_incompat[@]}")
+                incompat_tools+=("${glibc_pre_2_31_incompat[@]}")
               fi
             else
-              incompat_tools+=("${glibc_pre_2_31_incompat[@]}")
+              incompat_tools+=("${glibc_pre_2_34_incompat[@]}")
             fi
           else
-            incompat_tools+=("${glibc_pre_2_34_incompat[@]}")
+            incompat_tools+=("${glibc_pre_2_35_incompat[@]}")
           fi
         else
-          incompat_tools+=("${glibc_pre_2_35_incompat[@]}")
+          incompat_tools+=("${glibc_pre_2_39_incompat[@]}")
         fi
       fi
     fi
diff --git a/tools/codegen/base/zizmor.json b/tools/codegen/base/zizmor.json
new file mode 100644
index 00000000..79ea35c7
--- /dev/null
+++ b/tools/codegen/base/zizmor.json
@@ -0,0 +1,16 @@
+{
+  "repository": "https://github.com/zizmorcore/zizmor",
+  "tag_prefix": "v",
+  "rust_crate": "${package}",
+  "asset_name": "${package}-${rust_target}.tar.gz",
+  "version_range": ">= 1.9.0",
+  "platform": {
+    "x86_64_linux_gnu": {},
+    "x86_64_macos": {},
+    "x86_64_windows": {
+      "asset_name": "${package}-${rust_target}.zip"
+    },
+    "aarch64_linux_gnu": {},
+    "aarch64_macos": {}
+  }
+}