diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5445921
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  # Keeps the SHA-pinned actions in .github/workflows current.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ['*']
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 7693d18..09826c4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -32,6 +32,9 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint
@@ -79,7 +82,7 @@ jobs:
       SKIP_AD_REJOIN_CRON:      ${{ inputs.skip_ad_rejoin_cron }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # ── SSH setup ────────────────────────────────────────────────────────────
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f0fecd5..8abca15 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -7,15 +7,18 @@ on:
     branches: ["main"]
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   shellcheck:
     name: ShellCheck
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run ShellCheck
-        uses: ludeeus/action-shellcheck@2.0.0
+        uses: ludeeus/action-shellcheck@00cae500b08a931fb5698e11e79bfbd38e612a38 # 2.0.0
         with:
           scandir: "./scripts"
           severity: warning
@@ -24,7 +27,7 @@ jobs:
     name: Validate env.example completeness
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Check all template variables are documented in env.example
         run: |
@@ -52,7 +55,7 @@ jobs:
     name: Validate sudoers syntax
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Check sudoers drop-in with visudo
         run: visudo -cf config/sudoers.d/domain-groups
@@ -61,10 +64,10 @@ jobs:
     name: bats-core unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install bats-core
-        uses: bats-core/bats-action@2.0.0
+        uses: bats-core/bats-action@472edde1138d59aca53ff162fb8d996666d21e4a # 2.0.0
 
       - name: Run tests
         run: bats tests/