diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..2c48305b7eb
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c860ebe3a63..ce296b3927d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,5 +1,8 @@
 name: CI
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:
@@ -26,10 +29,10 @@ jobs:
         run: git config --global core.autocrlf false
         if: matrix.os == 'windows-latest'
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # https://github.com/actions/cache/blob/main/examples.md#rust---cargo
       # Depends on `Cargo.lock` --> Has to be after checkout.
-      - uses: actions/cache@v4
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/bin/
diff --git a/.github/workflows/winget.yml b/.github/workflows/winget.yml
index 949ef9a5009..d2f6abc0892 100644
--- a/.github/workflows/winget.yml
+++ b/.github/workflows/winget.yml
@@ -1,5 +1,8 @@
 name: Submit release to the WinGet community repository
 
+permissions:
+  contents: read
+
 on:
   release:
     types: [published]