diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..397ca2cf4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'weekly'
+    groups:
+      dependencies:
+        patterns:
+          - '*'
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index d473739a1..0633dd025 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         lfs: true
     - name: Clone submodules
@@ -17,12 +17,12 @@ jobs:
     - name: apt-get update
       run: sudo apt-get update
     - name: Set up JDK
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
       with:
         distribution: temurin
         java-version: 21
         cache: sbt
-    - uses: sbt/setup-sbt@v1
+    - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12
     - name: Compile and run tests
       run: sbt +test
     - name: Check formatting
@@ -30,7 +30,7 @@ jobs:
     - run: echo "Previous step failed because code is not formatted. Run 'sbt scalafmt'"
       if: ${{ failure() }}
     - name: Check if there are changes
-      uses: NathanielHill/fail-if-changes@master
+      uses: NathanielHill/fail-if-changes@043d2f3e52828fd3e37eb59acd44ef9d2e2b82bc # master
     - name: Check domain classes
       run: sbt generateDomainClassesCheck
     - run: echo "Previous step failed because latest domain classes are not committed. Run 'sbt generateDomainClasses' (should be triggered automatically by `sbt compile`, so maybe you just forgot to commit?)"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c0dd93d5c..cb28f6d3a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ jobs:
   test-codepropertygraph:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         lfs: true
         fetch-depth: 0
@@ -18,12 +18,12 @@ jobs:
     - name: apt-get update
       run: sudo apt-get update
     - name: Set up JDK
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
       with:
         distribution: temurin
         java-version: 21
         cache: sbt
-    - uses: sbt/setup-sbt@v1
+    - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12
     - name: Check formatting
       run: sbt scalafmtCheck Test/scalafmtCheck
     - run: echo "Previous step failed because code is not formatted. Run 'sbt scalafmt'"
@@ -40,7 +40,7 @@ jobs:
     needs: [test-codepropertygraph]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           lfs: true
           fetch-depth: 0
@@ -55,12 +55,12 @@ jobs:
         env:
             PGP_SECRET: ${{ secrets.PGP_SECRET }}
       - name: Set up JDK
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: 21
           cache: sbt
-      - uses: sbt/setup-sbt@v1
+      - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12
       - name: Release to Sonatype
         run: sbt ciReleaseTagNextVersion ciReleaseSonatype
         env:
@@ -71,7 +71,7 @@ jobs:
           echo "LATEST_TAG=$(git describe --tags --abbrev=0)" >> $GITHUB_ENV
       - name: Create Release
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: