diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 51b7f796..6669f147 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,5 @@ updates:
     commit-message:
       prefix: "chore"
       include: "scope"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-isos.yml b/.github/workflows/build-isos.yml
index 1a7bbcc5..e14f0247 100644
--- a/.github/workflows/build-isos.yml
+++ b/.github/workflows/build-isos.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Maximize Space
-        uses: easimon/maximize-build-space@v10
+        uses: easimon/maximize-build-space@fc881a613ad2a34aca9c9624518214ebc21dfc0c # v10
         with:
           overprovision-lvm: true
           remove-android: true
@@ -25,12 +25,12 @@ jobs:
           remove-docker-images: true
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
       - name: Install Lix
-        uses: samueldr/lix-gha-installer-action@v2025-10-27
+        uses: samueldr/lix-gha-installer-action@8c7f8a4b0f594ab8a6dc3bf71c217587bbc756b5 # v2025-10-27
         with:
           extra_nix_config: |
             substituters = https://nix-community.cachix.org https://catppuccin.cachix.org https://cache.nixos.org/ https://cache.tgirl.cloud/tgirlcloud/
diff --git a/.github/workflows/check-lock.yml b/.github/workflows/check-lock.yml
index 6ab6bd8c..dc150c82 100644
--- a/.github/workflows/check-lock.yml
+++ b/.github/workflows/check-lock.yml
@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: ${{ inputs.ref && inputs.ref || github.ref_name }}
           persist-credentials: false
 
       - name: Install Lix
-        uses: samueldr/lix-gha-installer-action@v2025-10-27
+        uses: samueldr/lix-gha-installer-action@8c7f8a4b0f594ab8a6dc3bf71c217587bbc756b5 # v2025-10-27
         with:
           extra_nix_config: |
             substituters = https://nix-community.cachix.org https://catppuccin.cachix.org https://cache.nixos.org/ https://cache.tgirl.cloud/tgirlcloud/
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 746140cf..e935bbfd 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -31,13 +31,13 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: ${{ inputs.ref && inputs.ref || github.ref_name }}
           persist-credentials: false
 
       - name: Install Lix
-        uses: samueldr/lix-gha-installer-action@v2025-10-27
+        uses: samueldr/lix-gha-installer-action@8c7f8a4b0f594ab8a6dc3bf71c217587bbc756b5 # v2025-10-27
         with:
           extra_nix_config: |
             substituters = https://nix-community.cachix.org https://catppuccin.cachix.org https://cache.nixos.org/ https://cache.tgirl.cloud/tgirlcloud/
diff --git a/.github/workflows/diff.yml b/.github/workflows/diff.yml
index 1dc9b996..93aba125 100644
--- a/.github/workflows/diff.yml
+++ b/.github/workflows/diff.yml
@@ -17,13 +17,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           ref: ${{ inputs.ref && inputs.ref || github.ref_name }}
           persist-credentials: false
 
       - name: Install Lix
-        uses: samueldr/lix-gha-installer-action@v2025-10-27
+        uses: samueldr/lix-gha-installer-action@8c7f8a4b0f594ab8a6dc3bf71c217587bbc756b5 # v2025-10-27
         with:
           extra_nix_config: |
             substituters = https://nix-community.cachix.org https://catppuccin.cachix.org https://cache.nixos.org/ https://cache.tgirl.cloud/tgirlcloud/
@@ -52,7 +52,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Run lix-diff
-        uses: isabelroses/lix-diff-action@main
+        uses: isabelroses/lix-diff-action@a09652283ba0df1f6841bd3383a7c119cadd3b8c # main
         with:
           attributes: ${{ steps.hosts.outputs.attributes }}
           comment-strategy: update
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 01ee0887..6e464583 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -19,12 +19,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
       - name: Install Lix
-        uses: samueldr/lix-gha-installer-action@v2025-10-27
+        uses: samueldr/lix-gha-installer-action@8c7f8a4b0f594ab8a6dc3bf71c217587bbc756b5 # v2025-10-27
         with:
           extra_nix_config: |
             substituters = https://nix-community.cachix.org https://catppuccin.cachix.org https://cache.nixos.org/ https://cache.tgirl.cloud/tgirlcloud/
@@ -34,7 +34,7 @@ jobs:
         run: nix build -L .#docs
 
       - name: Upload Pages Artifact
-        uses: "actions/upload-pages-artifact@v4"
+        uses: "actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b" # v4.0.0
         with:
           path: "result/"
 
@@ -53,4 +53,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index 0b4bfd99..4bd3f83a 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -21,12 +21,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           persist-credentials: false
 
       - name: Install Lix
-        uses: samueldr/lix-gha-installer-action@v2025-10-27
+        uses: samueldr/lix-gha-installer-action@8c7f8a4b0f594ab8a6dc3bf71c217587bbc756b5 # v2025-10-27
         with:
           extra_nix_config: |
             substituters = https://nix-community.cachix.org https://catppuccin.cachix.org https://cache.nixos.org/ https://cache.tgirl.cloud/tgirlcloud/
@@ -34,7 +34,7 @@ jobs:
 
       - name: Update Lockfile
         id: pr
-        uses: DeterminateSystems/update-flake-lock@v27
+        uses: DeterminateSystems/update-flake-lock@c5930b397a673a70ca70be06020e943aeac310a1 # v27
         with:
           commit-msg: "flake.lock: update all inputs"
           pr-title: "flake.lock: update all inputs"