diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7b8a83e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "daily"
+    cooldown:
+      default-days: 14
diff --git a/.github/workflows/asyncapi.yml b/.github/workflows/asyncapi.yml
index 0a24338..b46aa45 100644
--- a/.github/workflows/asyncapi.yml
+++ b/.github/workflows/asyncapi.yml
@@ -28,20 +28,22 @@ jobs:
       contents: write  # To push a branch
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Validate websocket-api
-        uses: WaleedAshraf/asyncapi-github-action@v0.0.10
+        uses: WaleedAshraf/asyncapi-github-action@d31f1627ac7c24132e7c4e4b89948d43b619685a # v0.0.10
         with:
           filepath: './core-api/websocket/UCR-core-asyncapi.yaml'
 
       - name: Validate integration-api
-        uses: WaleedAshraf/asyncapi-github-action@v0.0.10
+        uses: WaleedAshraf/asyncapi-github-action@d31f1627ac7c24132e7c4e4b89948d43b619685a # v0.0.10
         with:
           filepath: './integration-api/UCR-integration-asyncapi.yaml'
 
       - name: Validate dock-api
-        uses: WaleedAshraf/asyncapi-github-action@v0.0.10
+        uses: WaleedAshraf/asyncapi-github-action@d31f1627ac7c24132e7c4e4b89948d43b619685a # v0.0.10
         with:
           filepath: './dock-api/UCD2-asyncapi.yaml'
 
@@ -73,7 +75,7 @@ jobs:
 
       - name: Deploy core API GH page
         if: github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v')
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           branch: gh-pages
           folder: ./static/api/ws
@@ -81,7 +83,7 @@ jobs:
 
       - name: Deploy integration API GH page
         if: github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v')
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           branch: gh-pages
           folder: ./static/api/integration
@@ -89,7 +91,7 @@ jobs:
 
       - name: Deploy dock API GH page
         if: github.ref == 'refs/heads/main' || contains(github.ref, 'tags/v')
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           branch: gh-pages
           folder: ./static/api/dock
diff --git a/.github/workflows/deploy_mdbook.yml b/.github/workflows/deploy_mdbook.yml
index 83c1f75..cbcb03d 100644
--- a/.github/workflows/deploy_mdbook.yml
+++ b/.github/workflows/deploy_mdbook.yml
@@ -20,8 +20,9 @@ jobs:
     permissions:
       contents: write  # To push a branch
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
+          persist-credentials: false
           fetch-depth: 0
       - name: Install mdbook
         # latest version is not recommended, since it also includes breaking alpha & beta versions
@@ -40,7 +41,7 @@ jobs:
 
       - name: Cache cargo install
         id: cache-cargo-install
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.cargo/bin
@@ -58,7 +59,7 @@ jobs:
           mdbook build
 
       - name: Deploy to GitHub Pages
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           branch: gh-pages
           folder: book
diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index a5e1873..d806399 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -22,7 +22,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - name: Validate with redocli CLI
         run: |
           docker pull redocly/cli
@@ -35,12 +37,14 @@ jobs:
     needs: [ validate ]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
+        with:
+          persist-credentials: false
       - name: Prepare GH page deployment
         run: |
           cp ./core-api/rest/UCR-core-openapi.yaml ./core-api/rest/swagger-ui
       - name: Deploy core API GH page
-        uses: JamesIves/github-pages-deploy-action@v4
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           branch: gh-pages
           folder: ./core-api/rest/swagger-ui