diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 577fe39..62c5e17 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -55,3 +55,5 @@ updates:
         applies-to: security-updates
         patterns: ["*"]
         update-types: ["minor", "patch"]
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-unittest.yml b/.github/workflows/build-unittest.yml
index 94dce4d..70315ed 100644
--- a/.github/workflows/build-unittest.yml
+++ b/.github/workflows/build-unittest.yml
@@ -36,7 +36,7 @@ jobs:
         GITHUB_ACTIONS: 'true'
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
     
     - name: Build dotnet solutions
       run: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 13ca0e8..1fc206d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,11 +41,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -59,6 +59,6 @@ jobs:
       run: dotnet build TypeChat.sln
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/fix-dependabot-alerts.yml b/.github/workflows/fix-dependabot-alerts.yml
index c873a3c..6bf7430 100644
--- a/.github/workflows/fix-dependabot-alerts.yml
+++ b/.github/workflows/fix-dependabot-alerts.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           # Don't leave the default GITHUB_TOKEN in .git/config — the
@@ -52,18 +52,18 @@ jobs:
           # and we don't want push credentials reachable from those.
           persist-credentials: false
 
-      - uses: actions/setup-dotnet@v4
+      - uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
         with:
           dotnet-version: "8.0.x"
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           # The remediation script itself is Node.js; no project depends
           # on node, so we don't need a package-lock cache key.
           node-version: 24
 
       - name: Cache NuGet packages
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/.nuget/packages
           # Hash the central props file so a CPM change invalidates the
@@ -74,7 +74,7 @@ jobs:
 
       - name: Generate GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
         with:
           app-id: ${{ vars.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
@@ -100,7 +100,7 @@ jobs:
       # so we save under a run-id-suffixed key and restore from the prefix.
       - name: Restore rollback state
         id: restore-state
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ runner.temp }}/fix-dependabot-alerts-rollback-state.json
           key: fix-dep-rollback-state-v1-${{ github.run_id }}
@@ -128,7 +128,7 @@ jobs:
       # be forgotten and the same broken upgrade re-tried tomorrow.
       - name: Save rollback state
         if: always()
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ runner.temp }}/fix-dependabot-alerts-rollback-state.json
           # ``run_id`` is reused across job re-runs; include
@@ -166,7 +166,7 @@ jobs:
       - name: Refresh app token
         if: ${{ steps.fix.outputs.changes == 'true' && steps.build.outputs.build_ok == 'true' }}
         id: app-token-pr
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1.12.0
         with:
           app-id: ${{ vars.DEPENDABOT_APP_ID }}
           private-key: ${{ secrets.DEPENDABOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/spell_check.yml b/.github/workflows/spell_check.yml
index db2a1b9..ca0fa90 100644
--- a/.github/workflows/spell_check.yml
+++ b/.github/workflows/spell_check.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v3
+      uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
     - name: Use custom config file
       uses: crate-ci/typos@master