diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d53aba7..9229c3e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -13,3 +13,12 @@ updates:
     directory: "/app-auth/graphapponlytutorial/" # Location of package manifests
     schedule:
       interval: "weekly"
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/auto-merge-dependabot.yml b/.github/workflows/auto-merge-dependabot.yml
index 6022314..5fa8733 100644
--- a/.github/workflows/auto-merge-dependabot.yml
+++ b/.github/workflows/auto-merge-dependabot.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1
+        uses: dependabot/fetch-metadata@8348ea7f5d949b08c7f125a44b569c9626b05db3 # v1.7.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       
diff --git a/.github/workflows/gradle.yml b/.github/workflows/gradle.yml
index 46fc6d6..7f6cc84 100644
--- a/.github/workflows/gradle.yml
+++ b/.github/workflows/gradle.yml
@@ -22,23 +22,23 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     - name: Set up JDK 17
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@e9fbacdec3bb3b6036605a3e6f7995d66773a8c6 # v3.14.2
       with:
         java-version: '17'
         distribution: 'temurin'
     - name: Make user app gradlew executable
       run: chmod +x ./user-auth/graphtutorial/gradlew
     - name: Build user app with Gradle
-      uses: gradle/gradle-build-action@0d13054264b0bb894ded474f08ebb30921341cee
+      uses: gradle/gradle-build-action@0d13054264b0bb894ded474f08ebb30921341cee # v2.1.4
       with:
         build-root-directory: user-auth/graphtutorial
         arguments: build
     - name: Make app-only app gradlew executable
       run: chmod +x ./app-auth/graphapponlytutorial/gradlew
     - name: Build app-only app with Gradle
-      uses: gradle/gradle-build-action@0d13054264b0bb894ded474f08ebb30921341cee
+      uses: gradle/gradle-build-action@0d13054264b0bb894ded474f08ebb30921341cee # v2.1.4
       with:
         build-root-directory: app-auth/graphapponlytutorial
         arguments: build