diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c342639
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/build-app.yml b/.github/workflows/build-app.yml
index f088690..e13c9d7 100644
--- a/.github/workflows/build-app.yml
+++ b/.github/workflows/build-app.yml
@@ -31,7 +31,7 @@ jobs:
             arch: arm64
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Recreate .fk1.txt and .fk2.txt
         shell: bash
@@ -45,7 +45,7 @@ jobs:
           if [ -n "${FK2_TXT_B64:-}" ]; then printf "%s" "$FK2_TXT_B64" | openssl base64 -d -A > app/.fk2.txt; fi
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           check-latest: true
@@ -62,7 +62,7 @@ jobs:
           GOFLAGS="-trimpath" go build -ldflags="-s -w" -o dist/gradient-engineer.${{ matrix.os }}.${{ matrix.arch }} ./app
 
       - name: Upload binary artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: gradient-engineer.${{ matrix.os }}.${{ matrix.arch }}
           path: dist/gradient-engineer.${{ matrix.os }}.${{ matrix.arch }}
diff --git a/.github/workflows/build-toolbox.yml b/.github/workflows/build-toolbox.yml
index 18da36e..f464a15 100644
--- a/.github/workflows/build-toolbox.yml
+++ b/.github/workflows/build-toolbox.yml
@@ -31,17 +31,17 @@ jobs:
             arch: arm64
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           check-latest: true
           cache: true
 
       - name: Install Nix
-        uses: cachix/install-nix-action@v31
+        uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
 
       - name: Build toolbox builder
         shell: bash
@@ -67,7 +67,7 @@ jobs:
           ./toolbox-builder --playbook ../playbook/60-second-darwin.yaml --out .
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: toolbox.${{ matrix.os }}.${{ matrix.arch }}
           path: toolbox/*.tar.xz