diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 92e6440..7a79b4c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
+      # zizmor: ignore[cache-poisoning] -- mise verifies tool checksums via mise.lock
       - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3.6.3
         with:
           version: 2026.3.8