diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7ddd384
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    groups:
+      actions-minor-patch:
+        patterns:
+          - "*"
+        update-types:
+          - "minor"
+          - "patch"
+      actions-major:
+        patterns:
+          - "*"
+        update-types:
+          - "major"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index 273305b..57619f8 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -36,7 +36,7 @@ jobs:
         run: ./bin/create-release-artifacts.sh ${{ inputs.version }}
 
       - name: Create release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           tag: ${{ inputs.version }}
diff --git a/.github/workflows/on-version-changed.yml b/.github/workflows/on-version-changed.yml
index df75dd5..9c1a37e 100644
--- a/.github/workflows/on-version-changed.yml
+++ b/.github/workflows/on-version-changed.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           fetch-depth: 2
 
-      - uses: salsify/action-detect-and-tag-new-version@v2
+      - uses: salsify/action-detect-and-tag-new-version@b1778166f13188a9d478e2d1198f993011ba9864 # v2.0.3
         id: check-version
         with:
           version-command: jq '.version' package.json
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 789784f..a465eba 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -43,7 +43,7 @@ jobs:
         run: sudo apt-get install subversion -y
 
       - name: Deploy to plugin directory
-        uses: 10up/action-wordpress-plugin-deploy@stable
+        uses: 10up/action-wordpress-plugin-deploy@54bd289b8525fd23a5c365ec369185f2966529c2 # 2.3.0
         with:
           generate-zip: false
         env: