diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 9b0e7e07e05..9236059b001 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -19,6 +19,8 @@ updates:
         update-types:
           - "minor"
           - "patch"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "bundler"
     directory: /
     schedule:
diff --git a/.github/workflows/collections-renames.yml b/.github/workflows/collections-renames.yml
index 79200d75eca..12cda8e1e61 100644
--- a/.github/workflows/collections-renames.yml
+++ b/.github/workflows/collections-renames.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.repository_owner == 'github'
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
@@ -31,7 +31,7 @@ jobs:
 
       - name: Commit changes and open PR
         id: cpr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           commit-message: "✨ Autofixing renamed/removed collection items ✨"
           committer: "github-actions[bot] <actions@github.com>"
diff --git a/.github/workflows/explore-triage-commenter.yml b/.github/workflows/explore-triage-commenter.yml
index 10d6258ec21..b919c7cb8dd 100644
--- a/.github/workflows/explore-triage-commenter.yml
+++ b/.github/workflows/explore-triage-commenter.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Build triage comment data
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           OUTPUT_PATH: ${{ runner.temp }}/explore-triage-comment.json
         with:
@@ -203,7 +203,7 @@ jobs:
             }
 
       - name: Upload triage comment data
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: explore-triage-comment
           path: ${{ runner.temp }}/explore-triage-comment.json
diff --git a/.github/workflows/jekyll_build.yml b/.github/workflows/jekyll_build.yml
index 46298d6822f..ec0221469e6 100644
--- a/.github/workflows/jekyll_build.yml
+++ b/.github/workflows/jekyll_build.yml
@@ -53,4 +53,4 @@ jobs:
     steps:
       - name: 🚀 deploy
         id: deployment
-        uses: actions/deploy-pages@v5.0.1
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 699054da76e..f6d3b714777 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -13,7 +13,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Ruby
         uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
@@ -33,7 +33,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref || github.ref }}
 
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index f74776a2354..6064ceb675c 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -14,7 +14,7 @@ jobs:
       pull-requests: write # for actions/stale to close stale PRs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v11.0.0
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           stale-pr-message: >
             This pull request has been automatically marked as stale because it has not
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 73cb3e6fa01..1fcf67ba0fb 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -33,7 +33,7 @@ jobs:
           - test_type: all
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -62,7 +62,7 @@ jobs:
         if: |
           (matrix.test_type == 'collections' && steps.collections.outputs.changed) ||
           (matrix.test_type == 'all' && steps.all.outputs.changed)
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .api-cache.json
           key: api-cache-${{ matrix.test_type }}-${{ github.run_id }}