diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..fc02641
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+# Every action is pinned to a commit, so nothing updates by itself. Once a
+# week Dependabot proposes the newer releases in one pull request, moving each
+# commit and the version in its comment together.
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns: ["*"]
diff --git a/.github/workflows/install-test.yml b/.github/workflows/install-test.yml
index 3235746..ebd55ed 100644
--- a/.github/workflows/install-test.yml
+++ b/.github/workflows/install-test.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-24.04' || 'namespace-profile-linux-amd64-16x32' }}
     timeout-minutes: 75
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Fail early and loudly if the runner ever has less disk than this needs.
       - name: Check disk space
@@ -37,7 +37,7 @@ jobs:
           avail_gb=$(df -BG --output=avail / | tail -1 | tr -dc 0-9)
           [ "$avail_gb" -ge 40 ] || { echo "::error::only ${avail_gb} GB free, the ISO build and install test need ~40 GB"; exit 1; }
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Build the ISO
         run: NO_BOOT_OFFER=1 ./bin/omarchy-iso-make
@@ -118,7 +118,7 @@ jobs:
 
       - name: Upload test artifacts
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: install-test-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
diff --git a/.github/workflows/nightly-build.yml b/.github/workflows/nightly-build.yml
index 188d856..c8437e5 100644
--- a/.github/workflows/nightly-build.yml
+++ b/.github/workflows/nightly-build.yml
@@ -55,7 +55,7 @@ jobs:
     outputs:
       channels: ${{ steps.plan.outputs.channels }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - id: plan
         env:
@@ -82,7 +82,7 @@ jobs:
       VERSION: ${{ matrix.version }}
       RELEASE: ${{ matrix.release }}
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Runner
         run: |
@@ -98,7 +98,7 @@ jobs:
           avail_gb=$(df -BG --output=avail / | tail -1 | tr -dc 0-9)
           [ "$avail_gb" -ge 50 ] || { echo "::error::only ${avail_gb} GB free, the build, the install test and the image need ~50 GB"; exit 1; }
 
-      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         if: matrix.channel == 'edge'
 
       # No package cache, on purpose: every package the ISO is made of is
@@ -190,7 +190,7 @@ jobs:
           } >>"$GITHUB_STEP_SUMMARY"
 
       - name: Keep the release for the publish job
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-${{ matrix.channel }}-${{ github.run_id }}
           path: out/
@@ -200,7 +200,7 @@ jobs:
 
       - name: Keep the install test's logs
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: nightly-install-test-${{ matrix.channel }}-${{ github.run_id }}-${{ github.run_attempt }}
           path: |
@@ -243,7 +243,7 @@ jobs:
       RCLONE_CONFIG_R2_ENDPOINT: ${{ secrets.R2_ENDPOINT }}
       BUCKET: omarchy-nightly
     steps:
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: nightly-${{ matrix.channel }}-${{ github.run_id }}
           path: out
diff --git a/.github/workflows/unit-test.yml b/.github/workflows/unit-test.yml
index 6310014..84171f9 100644
--- a/.github/workflows/unit-test.yml
+++ b/.github/workflows/unit-test.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # The tests run where the code they cover runs: on Arch, the same as
       # the live ISO and an Omarchy workstation. The container boots systemd