diff --git a/CHANGELOG.md b/CHANGELOG.md
index 108e0c6..f6bdfbf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,7 @@
 
 ## v1.1.0
 
-All changes are backwards compatible for `@v1` callers: new inputs default
+All changes are backwards compatible for v1.0 callers: new inputs default
 to the v1.0 behaviour unless noted. New checks that can fail a build are
 marked ⚠.
 
@@ -57,6 +57,7 @@ marked ⚠.
 - Delivery template: PR scanning moved to Status checks, the weekly schedule moved to Image rescan.
 - New templates: image rescan, GHCR clean-up, OpenSSF Scorecard; Go release template uses tag push.
 - `templates/dependabot.yml` (actions, Docker digests, Go, npm, Terraform; grouped; 7-day cooldown).
+- Callers pin the shared workflows to a commit SHA with a `# vX.Y.Z` comment instead of `@v1`; `templates/zizmor.yml` requires a SHA for every `uses:`. There is no moving `v1` tag.
 - `org-settings/`: allowed actions, rulesets, security configuration, apply script with `baseline`, `opt-in` and `strict` phases.
 
 ## v1.0.0
diff --git a/README.md b/README.md
index 3415a2b..0112cc6 100644
--- a/README.md
+++ b/README.md
@@ -24,23 +24,25 @@ Status: in development, not released yet.
 
 ## Usage
 
-Call a workflow from a job in your repository:
+Call a workflow from a job in your repository, pinned to the commit SHA of a release:
 
 ```yaml
 jobs:
   go:
-    uses: privacybydesign/github-workflows/.github/workflows/go-checks.yml@v1
+    uses: privacybydesign/github-workflows/.github/workflows/go-checks.yml@<commit-sha> # v1.1.0
     permissions:
       contents: read
 ```
 
+Copy [`templates/dependabot.yml`](templates/dependabot.yml) and [`templates/zizmor.yml`](templates/zizmor.yml) to your `.github/` directory: Dependabot then bumps the SHA and the version comment when a new release comes out, and zizmor rejects workflows and actions that are not pinned to a SHA.
+
 The inputs of each workflow are documented in its file, under `on.workflow_call.inputs`. A reusable workflow gets no more permissions than the calling job grants, so grant the ones its file lists.
 
 On private repositories, artifact attestations are skipped, and `codeql.yml` and `dependency-review.yml` need GitHub Code Security.
 
 ## Versioning
 
-Releases are semver tags (`v1.2.0`) with a moving major tag (`v1`); breaking changes get a new major. Third-party actions are pinned to commit SHAs and kept up to date by Dependabot. See [CHANGELOG.md](CHANGELOG.md).
+Releases are semver tags (`v1.2.0`); breaking changes get a new major. There is no moving major tag: callers pin a commit SHA, so a release can't change under them. Third-party actions in these workflows are pinned the same way and kept up to date by Dependabot. See [CHANGELOG.md](CHANGELOG.md).
 
 ## License
 
diff --git a/templates/zizmor.yml b/templates/zizmor.yml
index c698e67..872fe90 100644
--- a/templates/zizmor.yml
+++ b/templates/zizmor.yml
@@ -3,7 +3,6 @@ rules:
   unpinned-uses:
     config:
       policies:
-        # Our own reusable workflows are referenced by major tag (v1).
-        privacybydesign/*: ref-pin
-        # Everything else must be pinned to a full commit SHA.
+        # Every action and reusable workflow, our own included, must be pinned
+        # to a full commit SHA (with a "# vX.Y.Z" comment for Dependabot).
         "*": hash-pin
diff --git a/zizmor.yml b/zizmor.yml
index c698e67..872fe90 100644
--- a/zizmor.yml
+++ b/zizmor.yml
@@ -3,7 +3,6 @@ rules:
   unpinned-uses:
     config:
       policies:
-        # Our own reusable workflows are referenced by major tag (v1).
-        privacybydesign/*: ref-pin
-        # Everything else must be pinned to a full commit SHA.
+        # Every action and reusable workflow, our own included, must be pinned
+        # to a full commit SHA (with a "# vX.Y.Z" comment for Dependabot).
         "*": hash-pin