diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5908ded2..60c6e00e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,7 +4,23 @@ updates:
     directory: "/" # Location of package manifests
     schedule:
       interval: "weekly"
+    # Hold back brand-new releases: the hours after publication are the window
+    # in which a compromised package version is most likely to still be live.
+    cooldown:
+      default-days: 7
     groups:
       dependencies:
         patterns:
           - "*"
+
+  # Keeps the exact action versions pinned in .github/workflows from going stale.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index a0e46aaa..8415a2be 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -24,16 +24,16 @@ jobs:
         shard: [1, 2, 3, 4, 5, 6, 7, 8]
       fail-fast: false
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           lfs: true
-      - uses: actions/cache@v3
+      - uses: actions/cache@v3.5.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             ${{ runner.os }}-node
-      - uses: actions/cache@v3
+      - uses: actions/cache@v3.5.0
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}-e2e
@@ -50,7 +50,7 @@ jobs:
         env:
           CI: true
       - name: Push test report to artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         if: failure()
         with:
           name: Test Results ${{ github.sha }}
diff --git a/.github/workflows/pr-to-s3.yml b/.github/workflows/pr-to-s3.yml
index 4837944f..1d29f1f8 100644
--- a/.github/workflows/pr-to-s3.yml
+++ b/.github/workflows/pr-to-s3.yml
@@ -9,8 +9,8 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'skip ci')"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/cache@v3
+      - uses: actions/checkout@v4.4.0
+      - uses: actions/cache@v3.5.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -24,7 +24,7 @@ jobs:
           rm -rf dist/samples/**/package-lock.json
           rm -rf dist/samples/**/app/.gitignore
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v4.3.1
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
diff --git a/.github/workflows/push-to-s3.yml b/.github/workflows/push-to-s3.yml
index ade49c7d..44217850 100644
--- a/.github/workflows/push-to-s3.yml
+++ b/.github/workflows/push-to-s3.yml
@@ -8,8 +8,8 @@ jobs:
     if: "!contains(github.event.head_commit.message, 'skip ci')"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/cache@v3
+      - uses: actions/checkout@v4.4.0
+      - uses: actions/cache@v3.5.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
@@ -23,7 +23,7 @@ jobs:
           rm -rf dist/samples/**/package-lock.json
           rm -rf dist/samples/**/app/.gitignore
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@v4.3.1
         with:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1931bab5..617259c5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,12 +12,12 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
           persist-credentials: false
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: '22'
           cache: 'npm'
@@ -42,7 +42,7 @@ jobs:
           GH_TOKEN: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
 
       - name: Semantic Release
-        uses: cycjimmy/semantic-release-action@v6
+        uses: cycjimmy/semantic-release-action@v6.0.0
         with:
           extra_plugins: |
             @semantic-release/commit-analyzer
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7f2f2b19..f90eda7c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -18,8 +18,8 @@ jobs:
       github.event.review.state == 'approved')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/cache@v3
+      - uses: actions/checkout@v4.4.0
+      - uses: actions/cache@v3.5.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
diff --git a/.github/workflows/update-devdoc.yml b/.github/workflows/update-devdoc.yml
index 3a3cb785..3aeacf9b 100644
--- a/.github/workflows/update-devdoc.yml
+++ b/.github/workflows/update-devdoc.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Dispatch Release Event
-        uses: peter-evans/repository-dispatch@v2
+        uses: peter-evans/repository-dispatch@v2.1.2
         with:
           token: ${{ secrets.WOOSMAP_GH_ACCESS_TOKEN }}
           repository: woosmap/developers.woosmap.com