diff --git a/changelog.d/19914.misc b/changelog.d/19914.misc
new file mode 100644
index 0000000000..029c3dd501
--- /dev/null
+++ b/changelog.d/19914.misc
@@ -0,0 +1 @@
+Harden the CI workflows and enforce this with a new zizmor lint workflow. Also fix a cache key calculation in one of the steps along the way. Contributed by Denis Kasak (@dkasak).