diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/create-prerelase.yml b/.github/workflows/create-prerelase.yml
index c5a43fbc..c40d2831 100644
--- a/.github/workflows/create-prerelase.yml
+++ b/.github/workflows/create-prerelase.yml
@@ -20,7 +20,7 @@ jobs:
       # needed to create a release
       contents: write
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           fetch-depth: 1
       - name: Build scripts 
@@ -36,7 +36,7 @@ jobs:
         with:
           tag: dev
       - name: Create new dev prerelease
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
         with:
           tag_name: dev
           name: dev branch preview
diff --git a/.github/workflows/create-release.yml b/.github/workflows/create-release.yml
index fed84ad5..4d5194f2 100644
--- a/.github/workflows/create-release.yml
+++ b/.github/workflows/create-release.yml
@@ -24,7 +24,7 @@ jobs:
       previous_tag: ${{ steps.bump.outputs.previous_tag }}
       new_tag: ${{ steps.bump.outputs.new_tag }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
       - id: bump
         name: Bump version
         run: |
@@ -60,7 +60,7 @@ jobs:
       contents: write 
     needs: new-version
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
         with:
           fetch-depth: 0
       - name: Build and sign release scripts
@@ -99,7 +99,7 @@ jobs:
           
           Set-Content -Value $changeLogContent -Path .\changelog.md
       - name: Create new release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844 # v0.1.15
         with:
           tag_name: ${{ needs.new-version.outputs.new_tag }} # ${{ github.ref }}
           name: MSLab ${{ needs.new-version.outputs.new_tag }} # ${{ github.ref }}