diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
deleted file mode 100644
index d06edf3..0000000
--- a/.github/dependabot.yaml
+++ /dev/null
@@ -1,13 +0,0 @@
-# To get started with Dependabot version updates, you'll need to specify which
-# package ecosystems to update and where the package manifests are located.
-# Please see the documentation for all configuration options:
-# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
-
-version: 2
-updates:
-  - package-ecosystem: "github-actions" # See documentation for possible values
-    directory: "/" # Location of package manifests
-    schedule:
-      interval: "monthly"
-    labels:
-      - "enhancement"
diff --git a/.github/renovate.json b/.github/renovate.json
index ed76b0f..8a76520 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -1,7 +1,7 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": ["config:recommended"],
-  "enabledManagers": ["mise"],
+  "enabledManagers": ["mise", "github-actions"],
   "schedule": ["before 6am on friday"],
   "labels": ["dependencies"],
   "prConcurrentLimit": 3,
@@ -9,6 +9,10 @@
     {
       "matchManagers": ["mise"],
       "groupName": "mise toolchain"
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "groupName": "github actions"
     }
   ]
 }
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 008079a..2a607bf 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -21,7 +21,7 @@ jobs:
     name: Lint shell scripts, markdown, and YAML
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
       - run: mise lint
 
@@ -29,7 +29,7 @@ jobs:
     name: Lint GitHub Actions workflows
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: docker://rhysd/actionlint@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 # 1.7.12
         with:
           args: -color
@@ -42,7 +42,7 @@ jobs:
       matrix:
         context: [personal, work]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
       - name: Stub chezmoi config (${{ matrix.context }} context)
         uses: ./.github/actions/write-chezmoi-config
@@ -59,6 +59,6 @@ jobs:
     name: Run bats tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d # v4.2.0
       - run: mise test