diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..da059f2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  # workflow の action（SHA 固定）を更新する。SHA と末尾の # vX.Y.Z コメントを合わせて書き換えた PR が作られる
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+      time: "10:00"
+      timezone: "Asia/Tokyo"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "chore(deps)"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 8f3c88c..850e879 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -2,13 +2,21 @@ name: PR check
 
 on: pull_request
 
+permissions:
+  contents: read
+
 jobs:
   danger:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write  # Danger が PR にコメントするため
+      issues: read  # Danger が PR の情報(ラベル等)を issues API で読むため
+      statuses: write  # Danger が結果をコミットステータスに付けるため
 
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Danger(SwiftLint)
-        uses: docker://ghcr.io/danger/danger-swift-with-swiftlint:3.8.0
+        uses: docker://ghcr.io/danger/danger-swift-with-swiftlint@sha256:2ad66810ba60c21eacae54e698e690ddd9fa61073253b19dc68dadc3b8f2a71b # 3.8.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}