diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..2c48305b7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/AutoIssueAssign.yml b/.github/workflows/AutoIssueAssign.yml
index a1b84374a..e27a51311 100644
--- a/.github/workflows/AutoIssueAssign.yml
+++ b/.github/workflows/AutoIssueAssign.yml
@@ -19,7 +19,7 @@ jobs:
     outputs:
       ExcludedUserList: ${{ steps.read.outputs.ExcludedUserList }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           sparse-checkout: .github/workflow-config.json
           sparse-checkout-cone-mode: false
diff --git a/.github/workflows/AutoLabelAssign.yml b/.github/workflows/AutoLabelAssign.yml
index 4c515b15c..9f1170d50 100644
--- a/.github/workflows/AutoLabelAssign.yml
+++ b/.github/workflows/AutoLabelAssign.yml
@@ -22,7 +22,7 @@ jobs:
             ExcludedUserList: ${{ steps.read.outputs.ExcludedUserList }}
             ExcludedBranchList: ${{ steps.read.outputs.ExcludedBranchList }}
         steps:
-            - uses: actions/checkout@v5
+            - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
               with:
                 sparse-checkout: .github/workflow-config.json
                 sparse-checkout-cone-mode: false
diff --git a/.github/workflows/AutoPublish.yml b/.github/workflows/AutoPublish.yml
index 5a0d25a8c..5b5f273da 100644
--- a/.github/workflows/AutoPublish.yml
+++ b/.github/workflows/AutoPublish.yml
@@ -21,7 +21,7 @@ jobs:
       EnableAutoPublish: ${{ steps.read.outputs.EnableAutoPublish }}
       EnableAutoMerge: ${{ steps.read.outputs.EnableAutoMerge }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           sparse-checkout: .github/workflow-config.json
           sparse-checkout-cone-mode: false
diff --git a/.github/workflows/BackgroundTasks.yml b/.github/workflows/BackgroundTasks.yml
index a79aca0bc..1ceaaffb1 100644
--- a/.github/workflows/BackgroundTasks.yml
+++ b/.github/workflows/BackgroundTasks.yml
@@ -22,7 +22,7 @@ jobs:
           mkdir -p ./pr
           echo $PayloadJson > ./pr/PayloadJson.json
           sed -i -e "s/$AccessToken/XYZ/g" ./pr/PayloadJson.json
-      - uses: actions/upload-artifact@v6
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: PayloadJson
           path: pr/
\ No newline at end of file
diff --git a/.github/workflows/Stale.yml b/.github/workflows/Stale.yml
index 69bae484e..29eac37c7 100644
--- a/.github/workflows/Stale.yml
+++ b/.github/workflows/Stale.yml
@@ -17,7 +17,7 @@ jobs:
     outputs:
       RunDebug: ${{ steps.read.outputs.RunDebug }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           sparse-checkout: .github/workflow-config.json
           sparse-checkout-cone-mode: false
diff --git a/.github/workflows/StaleBranch.yml b/.github/workflows/StaleBranch.yml
index 87beecbe2..9df850f83 100644
--- a/.github/workflows/StaleBranch.yml
+++ b/.github/workflows/StaleBranch.yml
@@ -25,7 +25,7 @@ jobs:
       RepoBranchSkipList: ${{ steps.read.outputs.RepoBranchSkipList }}
       ReportOnly: ${{ steps.read.outputs.ReportOnly }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           sparse-checkout: .github/workflow-config.json
           sparse-checkout-cone-mode: false
diff --git a/.github/workflows/TierManagement.yml b/.github/workflows/TierManagement.yml
index 21d7af2a2..44f65619c 100644
--- a/.github/workflows/TierManagement.yml
+++ b/.github/workflows/TierManagement.yml
@@ -20,7 +20,7 @@ jobs:
       EnableWriteSignOff: ${{ steps.read.outputs.EnableWriteSignOff }}
       EnableReadOnlySignoff: ${{ steps.read.outputs.EnableReadOnlySignoff }}
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           sparse-checkout: .github/workflow-config.json
           sparse-checkout-cone-mode: false