diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index d3c338c4..bda1df24 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,6 +9,8 @@ updates:
     schedule:
       # Check for updates to GitHub Actions every week
       interval: "weekly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: dotnet-sdk
     directory: /
     schedule:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 45442c76..baff50eb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,7 +25,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -38,7 +38,7 @@ jobs:
           azure-subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}
           permissions: '{"pull_requests":"write"}'
       - name: PR Metrics
-        uses: microsoft/PR-Metrics@v1.7.17
+        uses: microsoft/PR-Metrics@0959437740572519916a08b3609e67ffa435f8dd # v1.7.17
         env:
           PR_METRICS_ACCESS_TOKEN: ${{ steps.app-token.outputs.token }}
 
@@ -53,11 +53,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
       - name: Install SF SDK
@@ -88,11 +88,11 @@ jobs:
       IsReleaseBuild: true
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: '10.0.x'
       - name: Install SF SDK
diff --git a/.github/workflows/package-update.yml b/.github/workflows/package-update.yml
index ae199794..16f593e2 100644
--- a/.github/workflows/package-update.yml
+++ b/.github/workflows/package-update.yml
@@ -31,13 +31,13 @@ jobs:
           permissions: '{"contents":"write","issues":"write","pull_requests":"write"}'
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Install .NET 10 SDK
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           global-json-file: global.json