diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index e6782dc..b39814d 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -12,7 +12,7 @@ jobs:
       # contents:write is required to upload to the release assets
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           fetch-tags: 'true'
           ref: ${{ github.ref }}
@@ -53,10 +53,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           repository: asgrim/example-pie-extension
           path: ext
@@ -69,7 +69,7 @@ jobs:
           mv ext/zend_example_pie_extension.c .
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: ${{ matrix.php-versions }}
         env:
@@ -77,7 +77,7 @@ jobs:
           phpts: ${{ matrix.zts-mode }}
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -122,10 +122,10 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Checkout test extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           repository: asgrim/example-pie-extension
           path: ext
@@ -138,7 +138,7 @@ jobs:
           mv ext/zend_example_pie_extension.c .
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -171,7 +171,7 @@ jobs:
     needs: [test-action, test-action-alpine]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Delete test release
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bb862cc..89df385 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,15 +12,15 @@ jobs:
     name: Build dist and update tags
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
         with:
           ref: ${{ github.event.release.tag_name }}
-      - uses: actions/setup-node@v4
+      - name: Build dist
+        uses: miguelcolmenares/npm-auto-build@8c22581033b30b631ff66f6c1b72fa3bdc2ea312 # v2.1.2
         with:
-          node-version: '20'
-          cache: 'npm'
-      - run: npm ci
-      - run: npm run build
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+          node-version: '24'
+          build-only: 'true'
       - name: Commit dist to release tag
         run: |
           git config user.name "github-actions[bot]"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 0b9a6eb..fc990a8 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,12 +8,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.0
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.0.0
         with:
-          node-version: 20
+          node-version: '24'
           cache: 'npm'
 
       - name: Install Dependencies
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 0000000..c49ebf6
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,16 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended",
+    "helpers:pinGitHubActionDigests",
+    ":automergePatch",
+    ":automergeMinor",
+    ":automergeBranch"
+  ],
+  "packageRules": [
+    {
+      "matchManagers": ["github-actions"],
+      "pinDigests": true
+    }
+  ]
+}