diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..6cc0071
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/issue-branch-creation-handler.yml b/.github/workflows/issue-branch-creation-handler.yml
index b41f60d..068bf4a 100644
--- a/.github/workflows/issue-branch-creation-handler.yml
+++ b/.github/workflows/issue-branch-creation-handler.yml
@@ -12,15 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v2.5.0
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v2.5.0
         with:
           token: ${{ secrets.SCOPED_PAT }}
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: ".nvmrc"
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         id: npm_cache_id
         with:
           path: node_modules
diff --git a/.github/workflows/pr-validate-deploy.yml b/.github/workflows/pr-validate-deploy.yml
index 305ea0b..8e27116 100644
--- a/.github/workflows/pr-validate-deploy.yml
+++ b/.github/workflows/pr-validate-deploy.yml
@@ -64,12 +64,12 @@ jobs:
           ref: ${{ steps.resolve_target.outputs.checkout_ref }}
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: ".nvmrc"
 
       - name: Cache node modules
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         id: npm_cache_id
         with:
           path: node_modules
diff --git a/.github/workflows/push-to-main-handler.yml b/.github/workflows/push-to-main-handler.yml
index d2b1fd1..2e71b71 100644
--- a/.github/workflows/push-to-main-handler.yml
+++ b/.github/workflows/push-to-main-handler.yml
@@ -45,13 +45,13 @@ jobs:
 
       - name: Setup Node
         if: steps.requires-deploy.outputs.changed == '1'
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: ".nvmrc"
 
       - name: Cache Node Modules
         if: steps.requires-deploy.outputs.changed == '1'
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         id: npm_cache_id
         with:
           path: node_modules
diff --git a/.github/workflows/release-branch-merge-handler.yml b/.github/workflows/release-branch-merge-handler.yml
index 84c91f3..e033298 100644
--- a/.github/workflows/release-branch-merge-handler.yml
+++ b/.github/workflows/release-branch-merge-handler.yml
@@ -16,7 +16,7 @@ jobs:
     if: github.event.pull_request.merged == true && startsWith(github.base_ref, vars.RELEASE_BRANCH_PREFIX)
     steps:
       - name: Checkout
-        uses: actions/checkout@v2.5.0
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v2.5.0
         with:
           ref: ${{ github.base_ref }}
           fetch-depth: 0
diff --git a/.github/workflows/release-branch-pull-request-handler.yml b/.github/workflows/release-branch-pull-request-handler.yml
index 3147948..2f01e57 100644
--- a/.github/workflows/release-branch-pull-request-handler.yml
+++ b/.github/workflows/release-branch-pull-request-handler.yml
@@ -56,17 +56,17 @@ jobs:
           fi
           echo "branch=$branch" >> "$GITHUB_OUTPUT"
       - name: Checkout
-        uses: actions/checkout@v2.5.0
+        uses: actions/checkout@e2f20e631ae6d7dd3b768f56a5d2af784dd54791 # v2.5.0
         with:
           token: ${{ secrets.SCOPED_PAT }}
           ref: ${{ github.event_name == 'workflow_dispatch' && steps.resolve_pr.outputs.branch || github.event.pull_request.head.sha }}
           fetch-depth: 2
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: ".nvmrc"
       - name: Cache Node Modules
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         id: npm_cache_id
         with:
           path: node_modules