diff --git a/.github/workflows/shared-zizmor.yml b/.github/workflows/shared-zizmor.yml
index b7f3c6bd4..b0ef860f0 100644
--- a/.github/workflows/shared-zizmor.yml
+++ b/.github/workflows/shared-zizmor.yml
@@ -22,5 +22,13 @@ jobs:
         with:
           persist-credentials: false
 
+      - id: token
+        uses: immich-app/devtools/actions/create-workflow-token@caa599d954228439ea3e8ce1c3328f41ab120ee6 # create-workflow-token-action-v2.0.0
+        with:
+          client-id: ${{ secrets.PUSH_O_MATIC_APP_CLIENT_ID }}
+          private-key: ${{ secrets.PUSH_O_MATIC_APP_KEY }}
+
       - name: Run zizmor 🌈
         uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        with:
+          token: ${{ steps.token.outputs.token }}
diff --git a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml
index 8510fd85b..050e69b49 100644
--- a/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml
+++ b/tf/deployment/modules/shared/github/org/repo-files/.github/workflows/org-zizmor.yml
@@ -13,3 +13,4 @@ jobs:
       actions: read
       contents: read
       security-events: write
+    secrets: inherit