diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9cbb9b7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/check-signed-commits.yml b/.github/workflows/check-signed-commits.yml
index 4f08c94..24dbeef 100644
--- a/.github/workflows/check-signed-commits.yml
+++ b/.github/workflows/check-signed-commits.yml
@@ -3,6 +3,9 @@ name: Check signed commits in PR
 on:
   pull_request_target
 
+permissions:
+  contents: read
+
 jobs:
   check-signed-commits:
     name: Check signed commits in PR
@@ -11,5 +14,10 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
       - name: Check signed commits in PR
         uses: 1Password/check-signed-commits-action@v1
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e4f3a2b..f6e957d 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [main]
 
+permissions:
+  contents: read
+
 jobs:
   test:
     strategy:
@@ -14,7 +17,12 @@ jobs:
         os: [macos-latest, ubuntu-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v6
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Install bats (macOS)
         if: runner.os == 'macOS'