diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 59a4354cf..f7b98b9cf 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -25,6 +25,8 @@ updates:
       - dependencies
       - github_actions
       - Fanout
+    cooldown:
+      default-days: 7
   - package-ecosystem: "devcontainers"
     directory: "/"
     schedule:
diff --git a/.github/workflows/check-dist.yml b/.github/workflows/check-dist.yml
index 716c3ae4e..31cd7469a 100644
--- a/.github/workflows/check-dist.yml
+++ b/.github/workflows/check-dist.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: 'npm'
@@ -31,7 +31,7 @@ jobs:
   verify-index-js: # make sure the entrypoint js files run on a clean machine without compiling first
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: ./
         with:
diff --git a/.github/workflows/dependabot-build-dispatched.yml b/.github/workflows/dependabot-build-dispatched.yml
index 9ba8f068b..a4720087e 100644
--- a/.github/workflows/dependabot-build-dispatched.yml
+++ b/.github/workflows/dependabot-build-dispatched.yml
@@ -20,12 +20,12 @@ jobs:
   build-dependabot-changes:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # Use the ref provided by the workflow_dispatch input
           ref: ${{ github.event.inputs.ref }}
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: 'npm'
diff --git a/.github/workflows/dependabot-build.yml b/.github/workflows/dependabot-build.yml
index 56c9412cb..c5421a62d 100644
--- a/.github/workflows/dependabot-build.yml
+++ b/.github/workflows/dependabot-build.yml
@@ -37,14 +37,14 @@ jobs:
           app-id: ${{ secrets.DEPENDABOT_ACTION_TOKEN_AUTOMATION_CLIENT_ID }}
           private-key: ${{ secrets.DEPENDABOT_ACTION_TOKEN_AUTOMATION_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # fixes detached head state on Dependabot PRs
           ref: ${{ github.event.pull_request.head.ref }}
           # Check out using the generated token so any pushed changes will trigger checkruns
           token: ${{ steps.generate_token.outputs.token }}
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: 'npm'
diff --git a/.github/workflows/integration-test.yml b/.github/workflows/integration-test.yml
index bb46b4668..49a242c01 100644
--- a/.github/workflows/integration-test.yml
+++ b/.github/workflows/integration-test.yml
@@ -13,9 +13,9 @@ jobs:
   integration:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: 'npm'
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 813e6e091..7adeffb20 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -13,9 +13,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: 'npm'