diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8cd4fb90..166191f8 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -20,3 +20,5 @@ updates:
     time: "13:00"
   commit-message:
     prefix: "fix: "
+  cooldown:
+    default-days: 7
\ No newline at end of file
diff --git a/.github/workflows/CI.yml b/.github/workflows/CI.yml
index ef01d490..603083b1 100644
--- a/.github/workflows/CI.yml
+++ b/.github/workflows/CI.yml
@@ -10,12 +10,12 @@ on:
 
 jobs:
   validation:
-    uses: microsoft/action-python/.github/workflows/validation.yml@0.7.3
+    uses: microsoft/action-python/.github/workflows/validation.yml@00afd9876614ecf1b756489fdc3b604e92dee27d # 0.7.3
     with:
       workdir: '.'
 
   publish:
-    uses: microsoft/action-python/.github/workflows/publish.yml@0.6.4
+    uses: microsoft/action-python/.github/workflows/publish.yml@7d2126865ee9d3da8022d8a71c51734337eeae53 # 0.6.4
     secrets:
       PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
       TEST_PYPI_PASSWORD: ${{ secrets.TEST_PYPI_PASSWORD  }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 9d715609..33e4d911 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -4,7 +4,7 @@ on:
 
 jobs:
   publish:
-    uses: microsoft/action-python/.github/workflows/publish.yml@0.6.4
+    uses: microsoft/action-python/.github/workflows/publish.yml@7d2126865ee9d3da8022d8a71c51734337eeae53 # 0.6.4
     secrets:
       PYPI_PASSWORD: ${{ secrets.PYPI_PASSWORD }}
       TEST_PYPI_PASSWORD: ${{ secrets.TEST_PYPI_PASSWORD  }}
diff --git a/.github/workflows/schedule-update-actions.yml b/.github/workflows/schedule-update-actions.yml
index f4c30b60..0781048e 100644
--- a/.github/workflows/schedule-update-actions.yml
+++ b/.github/workflows/schedule-update-actions.yml
@@ -12,13 +12,13 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v3.5.2
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           # [Required] Access token with `workflow` scope.
           token: ${{ secrets.PAT }}
 
       - name: Run GitHub Actions Version Updater
-        uses: saadmk11/github-actions-version-updater@v0.7.4
+        uses: saadmk11/github-actions-version-updater@a7fd643bb3e9c1ef8f5c70bb5b645f5a2a9f395c # v0.7.4
         with:
           # [Required] Access token with `workflow` scope.
           token: ${{ secrets.PAT }}
diff --git a/.github/workflows/semantic-pr-check.yml b/.github/workflows/semantic-pr-check.yml
index 3a1158dc..d6e38003 100644
--- a/.github/workflows/semantic-pr-check.yml
+++ b/.github/workflows/semantic-pr-check.yml
@@ -12,6 +12,6 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5.2.0
+      - uses: amannn/action-semantic-pull-request@c3cd5d1ea3580753008872425915e343e351ab54 # v5.2.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/sphinx.yml b/.github/workflows/sphinx.yml
index d8498e6a..16c0bbbe 100644
--- a/.github/workflows/sphinx.yml
+++ b/.github/workflows/sphinx.yml
@@ -15,4 +15,4 @@ jobs:
       id-token: write
     steps:
     - id: deployment
-      uses: sphinx-notes/pages@v3
+      uses: sphinx-notes/pages@39eda6fbd411e7cee6e814ef84a69bd806346e92 # v3
diff --git a/.github/workflows/template-sync.yml b/.github/workflows/template-sync.yml
index 49666bc5..4c70ee1f 100644
--- a/.github/workflows/template-sync.yml
+++ b/.github/workflows/template-sync.yml
@@ -5,8 +5,8 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3.5.2 # important!
-      - uses: euphoricsystems/action-sync-template-repository@v2.5.1
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: euphoricsystems/action-sync-template-repository@1d6988701a0c6a14872e5c2b085ddbd6e63d3fa6 # v2.5.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           dry-run: true