diff --git a/.github/actions/validate-template/action.yml b/.github/actions/validate-template/action.yml
index 8bf52f0c..01d4f8ad 100644
--- a/.github/actions/validate-template/action.yml
+++ b/.github/actions/validate-template/action.yml
@@ -22,7 +22,7 @@ runs:
   using: composite
   steps:
     - name: Setup Deno environment
-      uses: denoland/setup-deno@v1
+      uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d # v1.5.2
       with:
         deno-version: v1.x
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/validate-template.yml b/.github/workflows/validate-template.yml
index ecee4933..a64ffad5 100644
--- a/.github/workflows/validate-template.yml
+++ b/.github/workflows/validate-template.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2.8.0
 
       - name: Validate template
         id: validate-template
@@ -21,7 +21,7 @@ jobs:
 
       - name: Create comment
         if: ${{ steps.validate-template.outputs.status != 0 && !github.event.pull_request.head.repo.fork }}
-        uses: peter-evans/create-or-update-comment@v1
+        uses: peter-evans/create-or-update-comment@a35cf36e5301d70b76f316e867e7788a55a31dae # v1.4.5
         with:
           issue-number: ${{ github.event.pull_request.number }}
           body: ${{ steps.validate-template.outputs.detail }}