diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..6cc00712d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3c0fc1582..1a2df1efb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         bundler-cache: true
     - name: Build and test site
diff --git a/.github/workflows/ensure-alphabetize.yml b/.github/workflows/ensure-alphabetize.yml
index f9f33ec20..887b9a1ed 100644
--- a/.github/workflows/ensure-alphabetize.yml
+++ b/.github/workflows/ensure-alphabetize.yml
@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         bundler-cache: true
     - name: Ensure Orgs are sorted
diff --git a/.github/workflows/ensure-orgs.yml b/.github/workflows/ensure-orgs.yml
index 78ae7c65e..7f676c30e 100644
--- a/.github/workflows/ensure-orgs.yml
+++ b/.github/workflows/ensure-orgs.yml
@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         bundler-cache: true
     - name: Ensure data entries are GitHub Orgs
diff --git a/.github/workflows/ensure-unique.yml b/.github/workflows/ensure-unique.yml
index 938ca2433..545e7e5f6 100644
--- a/.github/workflows/ensure-unique.yml
+++ b/.github/workflows/ensure-unique.yml
@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         bundler-cache: true
     - name: Ensure Orgs are unique
diff --git a/.github/workflows/rubucop.yml b/.github/workflows/rubucop.yml
index 6e6e06747..709ea7236 100644
--- a/.github/workflows/rubucop.yml
+++ b/.github/workflows/rubucop.yml
@@ -22,9 +22,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
     - name: Set up Ruby
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         bundler-cache: true
     - name: Rubocop