diff --git a/modules/zsh/module.json b/modules/zsh/module.json
index 8d965e972..028f2213d 100644
--- a/modules/zsh/module.json
+++ b/modules/zsh/module.json
@@ -14,6 +14,9 @@
       ]
     }
   ],
+  "uses": [
+    "operator-channel"
+  ],
   "tools": [
     "zsh_config"
   ],
diff --git a/modules/zsh/test/manifest.test.ts b/modules/zsh/test/manifest.test.ts
index 019e94eb0..9530b9779 100644
--- a/modules/zsh/test/manifest.test.ts
+++ b/modules/zsh/test/manifest.test.ts
@@ -28,6 +28,10 @@ test("it claims node-login-shell serving execute, and declares no seat", () => {
   assert.deepEqual(m.claims, [{ name: "node-login-shell", scope: "node", serves: ["execute"] }]);
 });
 
+test("it uses operator-channel, since its seat's verb execute is marked needs-approval (design 46/7 section 21)", () => {
+  assert.deepEqual(m.uses, ["operator-channel"]);
+});
+
 test("the .zshrc block is at the start and holds the three slots in order, after the defaults' header", () => {
   const rc = resource("rc");
   assert.equal(rc.path, "${machine:account-home}/.zshrc");