diff --git a/.github/workflows/docs-agent.yml b/.github/workflows/docs-agent.yml
index 0365f90aac8..7d530364f48 100644
--- a/.github/workflows/docs-agent.yml
+++ b/.github/workflows/docs-agent.yml
@@ -1,7 +1,7 @@
 name: Docs Agent
 
 on:
-  workflow_run:
+  workflow_run: # zizmor: ignore[dangerous-triggers] main-only docs repair after trusted CI; job gates repository, event, branch, actor, conclusion, and exact current main SHA before using write token
     workflows:
       - CI
     types: