diff --git a/.github/workflows/bundled_gems.yml b/.github/workflows/bundled_gems.yml
index 9acec6d41f..d329ee9b4b 100644
--- a/.github/workflows/bundled_gems.yml
+++ b/.github/workflows/bundled_gems.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ (github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull')) && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/default_gems_list.yml b/.github/workflows/default_gems_list.yml
index c4b4cd6d30..68f2d18dd6 100644
--- a/.github/workflows/default_gems_list.yml
+++ b/.github/workflows/default_gems_list.yml
@@ -23,7 +23,7 @@ jobs:
     if: ${{ github.repository == 'ruby/ruby' }}
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ (github.repository == 'ruby/ruby' && !startsWith(github.event_name, 'pull')) && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/post_push.yml b/.github/workflows/post_push.yml
index eed8d5b42c..e351c8c286 100644
--- a/.github/workflows/post_push.yml
+++ b/.github/workflows/post_push.yml
@@ -34,7 +34,7 @@ jobs:
           REDMINE_SYS_API_KEY: ${{ secrets.REDMINE_SYS_API_KEY }}
         if: ${{ github.ref == 'refs/heads/master' || startsWith(github.ref, 'refs/heads/ruby_') }}
 
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 500 # for notify-slack-commits
           token: ${{ secrets.MATZBOT_AUTO_UPDATE_TOKEN }}
diff --git a/.github/workflows/sync_default_gems.yml b/.github/workflows/sync_default_gems.yml
index 7fbddc48a2..3aaae5864f 100644
--- a/.github/workflows/sync_default_gems.yml
+++ b/.github/workflows/sync_default_gems.yml
@@ -34,7 +34,7 @@ jobs:
     if: ${{ github.repository == 'ruby/ruby' }}
 
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3 # zizmor: ignore[artipacked]
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         name: Check out ruby/ruby
         with:
           token: ${{ github.repository == 'ruby/ruby' && secrets.MATZBOT_AUTO_UPDATE_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 65b67fb6c8..2a8cad1d5c 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -1,6 +1,13 @@
 # Ignore existing findings (baseline)
 # Composite action findings are suppressed inline with # zizmor: ignore
 rules:
+  artipacked:
+    # These jobs push back to the repo and need persisted credentials.
+    ignore:
+      - bundled_gems.yml
+      - default_gems_list.yml
+      - post_push.yml
+      - sync_default_gems.yml
   dangerous-triggers:
     ignore:
       - auto_request_review.yml