diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..aa2f7456
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+
+    # Group all dependabot version update PRs into one
+    groups:
+      github-actions:
+        applies-to: version-updates
+        patterns:
+          - "*"
diff --git a/.github/workflows/node.js.yml b/.github/workflows/node.js.yml
index d74cb10f..f70d7edf 100644
--- a/.github/workflows/node.js.yml
+++ b/.github/workflows/node.js.yml
@@ -3,8 +3,9 @@
 name: Node.js CI
 
 on:
-  - push
-  - pull_request
+  pull_request:
+  push:
+    branches-ignore: "dependabot/**"
 
 jobs:
   build:
@@ -16,13 +17,14 @@ jobs:
         node-version: [18.x, 20.x]
 
     steps:
-    - name: Install xmllint
-      run: sudo apt-get install -y libxml2-utils
-    - uses: actions/checkout@v3
-    - name: Use Node.js ${{ matrix.node-version }}
-      uses: actions/setup-node@v3
-      with:
-        node-version: ${{ matrix.node-version }}
-        cache: 'npm'
-    - run: npm ci
-    - run: npm test
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Install xmllint
+        run: sudo apt-get install -y libxml2-utils
+      - name: Use Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+        with:
+          node-version: ${{ matrix.node-version }}
+          cache: 'npm'
+      - run: npm ci
+      - run: npm test
diff --git a/.github/workflows/spider-check.yaml b/.github/workflows/spider-check.yaml
index 0c75b5f1..d4802190 100644
--- a/.github/workflows/spider-check.yaml
+++ b/.github/workflows/spider-check.yaml
@@ -21,7 +21,8 @@ jobs:
       # Site address to crawl
       MY_SITE: https://api.jquery.com
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Run hydra-link-checker
         run: |
diff --git a/.github/workflows/typesense.yaml b/.github/workflows/typesense.yaml
index da194255..58bf1b65 100644
--- a/.github/workflows/typesense.yaml
+++ b/.github/workflows/typesense.yaml
@@ -16,7 +16,8 @@ jobs:
     if: ${{ github.repository_owner == 'jquery' }} # skip on forks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - name: Checkout
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Docsearch Scraper
         shell: bash
         run: |