diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6275012..a03176e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -7,6 +7,8 @@ updates:
       prefix: "MESH-2092 "
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     groups:
       dependencies:
         patterns:
@@ -18,6 +20,8 @@ updates:
       prefix: "MESH-2092 "
     schedule:
       interval: "daily"
+    cooldown:
+      default-days: 7
     groups:
       dependencies:
         patterns:
diff --git a/.github/workflows/dependabot-auto-merge.yaml b/.github/workflows/dependabot-auto-merge.yaml
index e2ee258..1c9c905 100644
--- a/.github/workflows/dependabot-auto-merge.yaml
+++ b/.github/workflows/dependabot-auto-merge.yaml
@@ -26,7 +26,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Auto-approve Dependabot PR
-        uses: hmarr/auto-approve-action@v4
+        uses: hmarr/auto-approve-action@8f929096a962e83ccdfa8afcf855f39f12d4dac7 # v4
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/scheduled-combine-dependabot-prs.yaml b/.github/workflows/scheduled-combine-dependabot-prs.yaml
index 2255b0b..547910d 100644
--- a/.github/workflows/scheduled-combine-dependabot-prs.yaml
+++ b/.github/workflows/scheduled-combine-dependabot-prs.yaml
@@ -25,7 +25,7 @@ jobs:
     steps:
       - name: combine-prs
         id: combine-prs
-        uses: github/combine-prs@v5.2.0
+        uses: github/combine-prs@2909f404763c3177a456e052bdb7f2e85d3a7cb3 # v5.2.0
         with:
           ci_required: ${{ inputs.ci_required == 'YES' }}
           labels: dependencies