diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..a9c1b32
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      external-github-actions:
+          patterns:
+              - '*/*'
+          exclude-patterns:
+              - Tricentis*/*
diff --git a/.github/workflows/chat.yaml b/.github/workflows/chat.yaml
index acd07bc..4b0b5f3 100644
--- a/.github/workflows/chat.yaml
+++ b/.github/workflows/chat.yaml
@@ -8,7 +8,7 @@ env:
 
 jobs:
   build:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-stepsecurity-x64
     strategy:
       matrix:
         target: [x86_64-unknown-linux-musl]
@@ -16,12 +16,12 @@ jobs:
     steps:
       - name: add gtk
         run: sudo apt-get install -y libgtk2.0-dev libglib2.0-dev
-      - uses: actions/checkout@v4
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: step-security/actions-rs-toolchain@40a2f87e50bed6faa2d050e99810b226b75d8c8a # v1.0.7
         with:
           toolchain: 1.70.0
           target: ${{ matrix.target }}
-      - uses: ClementTsang/cargo-action@v0.0.3
+      - uses: ClementTsang/cargo-action@3a7eb8bd7347b80ca95ab635409efd17d12156c2 # v0.0.3
         with:
           command: build
           args: --release --target=${{ matrix.target }}
diff --git a/.github/workflows/enforce-pr-jira-association.yml b/.github/workflows/enforce-pr-jira-association.yml
index 62860bc..bd3ac68 100644
--- a/.github/workflows/enforce-pr-jira-association.yml
+++ b/.github/workflows/enforce-pr-jira-association.yml
@@ -10,12 +10,12 @@ on:
 
 jobs:
   enforce-issue:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-stepsecurity-x64
     name: JIRA Association
     steps:
       - name: Check for JIRA ISSUE
         id: check
-        uses: usehaystack/jira-pr-link-action@v4
+        uses: usehaystack/jira-pr-link-action@22aff45075226d8971865093c4c0473262f351ed # v4
         with:
           ignore-author: dependabot[bot]
           project: "DEV2"
diff --git a/.github/workflows/lua-format-check-pr.yml b/.github/workflows/lua-format-check-pr.yml
index b67a873..bfc9e9b 100644
--- a/.github/workflows/lua-format-check-pr.yml
+++ b/.github/workflows/lua-format-check-pr.yml
@@ -10,16 +10,16 @@ permissions:
   pull-requests: write
 jobs:
   format_code:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-stepsecurity-x64
     steps:
-      - uses: actions/checkout@v4
-      - uses: JohnnyMorganz/stylua-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: JohnnyMorganz/stylua-action@479972f01e665acfcba96ada452c36608bdbbb5e # v4.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           version: latest
           args: .
       - name: suggester
-        uses: reviewdog/action-suggester@v1
+        uses: step-security/action-suggester@854bdfbbb12a23c87d847a6a435eb2e83453407e # v1.24.3
         with:
           tool_name: stylua
           fail_on_error: true