diff --git a/.github/.cspell/project-dictionary.txt b/.github/.cspell/project-dictionary.txt
index 23960187..d309345e 100644
--- a/.github/.cspell/project-dictionary.txt
+++ b/.github/.cspell/project-dictionary.txt
@@ -2,9 +2,7 @@ almalinux
 archlinux
 binstall
 callgrind
-CDPATH
 convco
-coreutils
 covgate
 cyclonedx
 cygdrive
@@ -30,7 +28,6 @@ microdnf
 minisig
 mirrorlist
 nextest
-oxfmt
 pluginconf
 ppcle
 prek
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index ab5c01c7..0f3934d4 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -4,3 +4,4 @@
 rules:
   anonymous-definition: { disable: true } # This is pedantic/auditor only audit and requires explicitly naming each job, but is usually redundant.
   dependabot-cooldown: { config: { days: 14 } }
+  unpinned-images: { disable: true }
diff --git a/tools/tidy.sh b/tools/tidy.sh
index 2796be0f..702a15c9 100755
--- a/tools/tidy.sh
+++ b/tools/tidy.sh
@@ -37,7 +37,7 @@ image='ghcr.io/taiki-e/tidy'
 if [[ -n "${TIDY_DEV:-}" ]]; then
   image+=':latest'
 else
-  image+='@sha256:151cd5c4f7c88bd21322c7dab255d60e699ffe4d4903e4e712429952537df6cf'
+  image+='@sha256:99d576935b91cbb7c97ad4b11b8888c5f36a0b8a720d2bab9a2ac3cc2a4b97c7'
 fi
 user="$(id -u):$(id -g)"
 workdir="${PWD}"