diff --git a/.github/workflows/review-smoke.yml b/.github/workflows/review-smoke.yml
index 1b8c59e..852b724 100644
--- a/.github/workflows/review-smoke.yml
+++ b/.github/workflows/review-smoke.yml
@@ -40,8 +40,11 @@ jobs:
             dir: examples/review-smoke-dashboard
           - app: cli
             dir: examples/review-smoke-cli
-    # A pull request from a fork gets no secrets, so the review could not run.
-    if: github.event.pull_request.head.repo.full_name == github.repository
+    # A pull request from a fork gets no secrets, and one from Dependabot gets
+    # only the Dependabot secrets, so the review could not run on either.
+    if: >-
+      github.event.pull_request.head.repo.full_name == github.repository &&
+      github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     # The explorer alone may use its 20 minutes; the base build and the judge come after.
     timeout-minutes: 45
diff --git a/action.yml b/action.yml
index dfce0e0..46472ef 100644
--- a/action.yml
+++ b/action.yml
@@ -40,7 +40,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@v7
+    - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ inputs.node-version }}