diff --git a/.echoes.toml b/.echoes.toml
new file mode 100644
index 000000000..04dd7cd1f
--- /dev/null
+++ b/.echoes.toml
@@ -0,0 +1,6 @@
+threshold = 2
+min-tokens = 0
+functions = true
+fn-min-tokens = 30
+context-blocks = true
+context-min-tokens = 30
diff --git a/.github/workflows/echoes-post.yml b/.github/workflows/echoes-post.yml
new file mode 100644
index 000000000..2a0f6b40e
--- /dev/null
+++ b/.github/workflows/echoes-post.yml
@@ -0,0 +1,45 @@
+---
+name: echoes-post
+
+"on":
+  workflow_run: # zizmor: ignore[dangerous-triggers] the job reads only the scan's payload
+    workflows: [echoes]
+    types: [completed]
+
+permissions: {}
+
+# This job holds a write token, so it never checks out or runs pull request
+# code. The action posts only to the open pull request whose head the scan built.
+jobs:
+  post:
+    name: Post ${{ matrix.name }}
+    if: >-
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      actions: read
+      pull-requests: write
+    strategy:
+      fail-fast: false
+      # The workspace names of the matrix in echoes.yml.
+      matrix:
+        name:
+          - root
+          - fuzz
+          - diesel-e2e
+          - schema-aware-roundtrip
+    steps:
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: echoes-payload-${{ matrix.name }}
+          path: ${{ runner.temp }}/echoes-payload
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ github.token }}
+
+      - uses: LucaCappelletti94/cargo-echoes@fe825077e5322a8bd3fa82c8c5a55f2d49cbe016 # v1.10.2
+        with:
+          mode: post
+          payload: ${{ runner.temp }}/echoes-payload
+          max-comments: 20
diff --git a/.github/workflows/echoes.yml b/.github/workflows/echoes.yml
new file mode 100644
index 000000000..f911dead3
--- /dev/null
+++ b/.github/workflows/echoes.yml
@@ -0,0 +1,61 @@
+---
+name: echoes
+
+"on":
+  pull_request:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: echoes-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+# Prepares one review per workspace with no write token, so fork pull requests
+# are scanned too. echoes-post.yml posts the reviews.
+jobs:
+  scan:
+    name: Echoes ${{ matrix.name }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false
+      # Every Cargo workspace, since a scan reads only the one around its cwd.
+      # echoes-post.yml lists the same names.
+      matrix:
+        include:
+          - name: root
+            cwd: .
+          - name: fuzz
+            cwd: fuzz
+          - name: diesel-e2e
+            cwd: integration-tests/diesel-e2e
+          - name: schema-aware-roundtrip
+            cwd: integration-tests/schema-aware-roundtrip
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: LucaCappelletti94/cargo-echoes@fe825077e5322a8bd3fa82c8c5a55f2d49cbe016 # v1.10.2
+        with:
+          cwd: ${{ matrix.cwd }}
+          version: 0.9.0
+          threshold: 2
+          min-tokens: 0
+          functions: true
+          fn-min-tokens: 30
+          context-blocks: true
+          context-min-tokens: 30
+          all-targets: true
+          max-comments: 20
+          pr-number: ${{ github.event.pull_request.number }}
+          mode: prepare
+          payload: ${{ runner.temp }}/echoes-payload
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: echoes-payload-${{ matrix.name }}
+          path: ${{ runner.temp }}/echoes-payload
+          retention-days: 7
+          if-no-files-found: error
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
new file mode 100644
index 000000000..3c1b7e12b
--- /dev/null
+++ b/.github/workflows/zizmor.yml
@@ -0,0 +1,32 @@
+---
+name: zizmor
+
+"on":
+  pull_request:
+  push:
+    branches:
+      - main
+
+permissions: {}
+
+concurrency:
+  group: zizmor-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# The findings go to code scanning, whose pull request check flags the alerts a
+# change introduces, since the older workflows still carry findings of their own.
+jobs:
+  zizmor:
+    name: Audit the workflows and actions
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        with:
+          version: 1.30.1