diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c48305
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/cmind-lint.yml b/.github/workflows/cmind-lint.yml
index e91cb63..ffd347a 100644
--- a/.github/workflows/cmind-lint.yml
+++ b/.github/workflows/cmind-lint.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run markdownlint-cli2
-        uses: DavidAnson/markdownlint-cli2-action@v19
+        uses: DavidAnson/markdownlint-cli2-action@05f32210e84442804257b2a6f20b273450ec8265 # v19.1.0
         with:
           globs: |
             CoderMind/**/*.md
diff --git a/.github/workflows/cmind-pre-release.yml b/.github/workflows/cmind-pre-release.yml
index beca2a8..846bd1d 100644
--- a/.github/workflows/cmind-pre-release.yml
+++ b/.github/workflows/cmind-pre-release.yml
@@ -26,7 +26,7 @@ jobs:
       PROJECT_DIR: CoderMind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -50,7 +50,7 @@ jobs:
           SCRIPTS: "sh ps"
         run: .github/workflows/scripts/cmind/create-release-packages.sh "${{ steps.get_tag.outputs.new_version }}"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         if: steps.check_release.outputs.exists == 'false'
         with:
           python-version: "3.12"
diff --git a/.github/workflows/cmind-release.yml b/.github/workflows/cmind-release.yml
index 60fc861..ec826cb 100644
--- a/.github/workflows/cmind-release.yml
+++ b/.github/workflows/cmind-release.yml
@@ -25,7 +25,7 @@ jobs:
       PROJECT_DIR: CoderMind
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -53,7 +53,7 @@ jobs:
           SCRIPTS: "sh ps"
         run: .github/workflows/scripts/cmind/create-release-packages.sh "${{ steps.get_tag.outputs.new_version }}"
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         if: steps.check_release.outputs.exists == 'false'
         with:
           python-version: "3.12"
diff --git a/.github/workflows/cmind-security-tests.yml b/.github/workflows/cmind-security-tests.yml
index af88079..c45382d 100644
--- a/.github/workflows/cmind-security-tests.yml
+++ b/.github/workflows/cmind-security-tests.yml
@@ -24,10 +24,10 @@ jobs:
       run:
         shell: pwsh
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
       - name: Build and install wheel on disposable CI runner
diff --git a/CoderMind/docs/project-structure.md b/CoderMind/docs/project-structure.md
index fb88525..9c1c053 100644
--- a/CoderMind/docs/project-structure.md
+++ b/CoderMind/docs/project-structure.md
@@ -178,3 +178,9 @@ Runtime logs are written under `~/.cmind/workspaces/<workspace-id>/logs/`, for e
 Execution traces are written under `~/.cmind/workspaces/<workspace-id>/data/trajectory/`. Review or diagnostic artifacts may be written under `<workspace>/.cmind/reports/` when a command generates them.
 
 To discover the home-side paths (data / logs / inner-git) for the current workspace, run `cmind version` from anywhere inside it—the relevant lines are labelled **Workspace**, **Data**, **Logs**, and **Inner git**.
+
+## Repository CI Configuration
+
+In the CoderMind source repository, remote actions in [GitHub workflows](../../.github/workflows/) are pinned to full-length commit SHAs with version comments, rather than mutable tags. When updating an action manually, verify the upstream release commit and update both the SHA and its version comment. Local reusable workflow references stay relative to the repository.
+
+[Dependabot](../../.github/dependabot.yml) checks GitHub Actions weekly, groups their updates, and applies a seven-day cooldown before proposing newly released versions. The pins and cooldown reduce supply-chain risk; they do not replace reviewing action updates.