diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..da059f2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  # workflow の action（SHA 固定）を更新する。SHA と末尾の # vX.Y.Z コメントを合わせて書き換えた PR が作られる
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "10:00"
+      timezone: "Asia/Tokyo"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
diff --git a/.github/workflows/pr_check.yml b/.github/workflows/pr_check.yml
index 08d3e04..6217413 100644
--- a/.github/workflows/pr_check.yml
+++ b/.github/workflows/pr_check.yml
@@ -2,9 +2,17 @@ name: PR check
 
 on: [pull_request]
 
+permissions:
+  contents: read
+
 jobs:
   danger:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # Danger が PR にコメントするため
+      issues: read  # Danger が PR の情報(ラベル等)を issues API で読むため
+      statuses: write  # Danger が結果をコミットステータスに付けるため
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Setup Java
@@ -12,7 +20,7 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '17'
-      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches
@@ -42,7 +50,7 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '17'
-      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches
diff --git a/.github/workflows/unit_test.yml b/.github/workflows/unit_test.yml
index e95f2f6..aceb385 100644
--- a/.github/workflows/unit_test.yml
+++ b/.github/workflows/unit_test.yml
@@ -5,6 +5,9 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
   unit_test:
     runs-on: ubuntu-latest
@@ -15,7 +18,7 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '17'
-      - uses: actions/cache@8492260343ad570701412c2f464a5877dc76bace # v2
+      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.gradle/caches