diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..6cc0071
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index 4326189..b1d21f4 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -14,13 +14,13 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Check out test fixture
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: 3ff4cb51f2cedc0a6415b31966353dd352d0d426
           fetch-depth: 0
 
       - name: Check out action under test
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           path: _action
           ref: ${{ github.event.pull_request.head.sha }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5572fbe..692d4ba 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,7 +27,7 @@ jobs:
       pull-requests: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -62,7 +62,7 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ steps.version.outputs.next }}
           name: ${{ steps.version.outputs.next }}
diff --git a/.github/workflows/test-cli-generic.yml b/.github/workflows/test-cli-generic.yml
index 6bc3fc8..f23bef5 100644
--- a/.github/workflows/test-cli-generic.yml
+++ b/.github/workflows/test-cli-generic.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout cli/cli
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: cli/cli
           ref: ${{ inputs.head-ref }}
diff --git a/.github/workflows/test-cli.yml b/.github/workflows/test-cli.yml
index 46f8f34..085912a 100644
--- a/.github/workflows/test-cli.yml
+++ b/.github/workflows/test-cli.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout cli/cli
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: cli/cli
           ref: ${{ inputs.head-ref }}
@@ -32,7 +32,7 @@ jobs:
         run: git fetch origin ${{ inputs.base-ref }}
 
       - name: Checkout instructions file
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: github/copilot-release-notes
           path: _action-config
diff --git a/.github/workflows/test-custom.yml b/.github/workflows/test-custom.yml
index f1d451a..60bf65f 100644
--- a/.github/workflows/test-custom.yml
+++ b/.github/workflows/test-custom.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout desktop/desktop
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: desktop/desktop
           ref: ${{ inputs.head-ref }}
@@ -32,7 +32,7 @@ jobs:
         run: git fetch origin ${{ inputs.base-ref }}
 
       - name: Checkout instructions file
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: github/copilot-release-notes
           path: _action-config
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b02aa5b..6e2f74d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout desktop/desktop
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: desktop/desktop
           ref: ${{ inputs.head-ref }}