diff --git a/.github/actions/setup-environment/action.yaml b/.github/actions/setup-environment/action.yaml
index a018867..32bd35a 100644
--- a/.github/actions/setup-environment/action.yaml
+++ b/.github/actions/setup-environment/action.yaml
@@ -64,7 +64,7 @@ runs:
         echo "base-sha=$BASE_SHA" >> $GITHUB_OUTPUT
         echo "head-sha=$HEAD_SHA" >> $GITHUB_OUTPUT
     - name: "install-uv"
-      uses: astral-sh/setup-uv@v6
+      uses: astral-sh/setup-uv@d0cc045d04ccac9d8b7881df0226f9e82c39688e # v6.8.0
       with:
         version: "0.9"
     - id: "update-docker-data-root"
diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index b778454..930b01c 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -12,6 +12,8 @@ updates:
     commit-message:
       prefix: ":arrow_up: dep-bump"
       include: scope
+    cooldown:
+      default-days: 7
   - package-ecosystem: pip
     directory: /
     schedule:
@@ -23,4 +25,4 @@ updates:
           - "*"
     commit-message:
       prefix: ":arrow_up: dep-bump"
-      include: scope
+      include: scope
\ No newline at end of file
diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index 95c8ce4..50d20ab 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -8,7 +8,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2.5.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Enable auto-merge for Dependabot PRs
diff --git a/.github/workflows/build-docs.yaml b/.github/workflows/build-docs.yaml
index 560140e..82cce8f 100644
--- a/.github/workflows/build-docs.yaml
+++ b/.github/workflows/build-docs.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: "ubuntu-24.04"
     name: "generate-docs"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
@@ -32,6 +32,6 @@ jobs:
           uv sync
           uv run mkdocs build
       - name: "upload-gh-pages"
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: "dist/site"
diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml
index 89b9d3b..015de5d 100644
--- a/.github/workflows/checks.yaml
+++ b/.github/workflows/checks.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: "ubuntu-24.04"
     name: "check"
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           ref: ${{ inputs.sha }}
           fetch-depth: 0
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 310dc7a..1bd34cb 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -25,18 +25,18 @@ jobs:
       matrix:
         language: [ "python" ]
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
       with:
         ref: ${{ inputs.sha }}
         fetch-depth: 0
         fetch-tags: true
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
       with:
         languages: ${{ matrix.language }}
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v3
+      uses: github/codeql-action/autobuild@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d45921a..cc425db 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,4 +15,4 @@ jobs:
     steps:
       - name: "deploy-gh-pages"
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5