diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
index 7de7445..cf4283e 100644
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
 
       - name: Bootstrap
-        uses: ./.github/actions/bootstrap
+        uses: $/.github/actions/bootstrap
 
       - name: Build Storybook
         run: bun run build-storybook
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index bb5e365..312f18c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,6 +11,6 @@ concurrency:
 jobs:
   test:
     name: Tests
-    uses: ./.github/workflows/test.yml
+    uses: $/.github/workflows/test.yml
     permissions:
       contents: read
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 7916dc3..e57f16d 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -10,6 +10,6 @@ concurrency:
 jobs:
   test:
     name: Tests
-    uses: ./.github/workflows/test.yml
+    uses: $/.github/workflows/test.yml
     permissions:
       contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 104b502..aa78cdb 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ permissions: {}
 jobs:
   test:
     name: Tests
-    uses: ./.github/workflows/test.yml
+    uses: $/.github/workflows/test.yml
     permissions:
       contents: read
 
@@ -28,10 +28,10 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: ./.github/actions/bootstrap
+      - uses: $/.github/actions/bootstrap
 
       - name: Fetch release secrets
-        uses: ./.github/actions/fetch-release-secrets
+        uses: $/.github/actions/fetch-release-secrets
         with:
           role-to-assume: ${{ secrets.RELEASE_ROLE_ARN }}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 58afb14..25024ac 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -12,7 +12,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: ./.github/actions/bootstrap
+      - uses: $/.github/actions/bootstrap
       - name: Check formatting
         run: bun run format:check
       - name: Restore ESLint cache
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - uses: ./.github/actions/bootstrap
+      - uses: $/.github/actions/bootstrap
       - name: Get Playwright version
         id: playwright-version
         run: echo "version=$(jq -r '.devDependencies.playwright' package.json)" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index ee58c17..f31b0c1 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -56,3 +56,11 @@ jobs:
         with:
           sarif_file: zizmor.sarif
           category: zizmor
+
+      # zizmor always exits 0 in SARIF mode, so fail here (after the upload
+      # so findings still reach code scanning) when the SARIF has results.
+      - name: Fail on findings
+        if: steps.changes.outputs.github == 'true'
+        run: |
+          jq -r '.runs[].results[] | "\(.level): \(.ruleId) — \(.locations[0].physicalLocation.artifactLocation.uri):\(.locations[0].physicalLocation.region.startLine // "?") \(.message.text)"' zizmor.sarif
+          jq -e '[.runs[].results[]] | length == 0' zizmor.sarif > /dev/null