diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 969a3c2a9b..56301e9524 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -1,5 +1,9 @@
 name: Tests
 
+# NOTE: .github/zizmor.yml carries a cache-poisoning exception for this entire
+# file because this step doesn't publish anything at the moment. If this
+# changes, the exception should be removed.
+
 on:
   push:
     branches: ["develop", "release-*"]
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000000..894ff442a2
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,11 @@
+# Configuration for the zizmor GitHub Actions security scanner.
+# See https://docs.zizmor.sh/configuration/
+
+rules:
+  cache-poisoning:
+    # The cache-poisoning findings in tests.yml are all false positives. The
+    # findings are produced because its `push` trigger *could* belong to a
+    # publishing workflow, but it publishes nothing. Its only artifacts are
+    # test logs.
+    ignore:
+      - tests.yml