diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 70a53815e..e18b3bbc5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -55,3 +55,5 @@ updates:
      github-actions:
        patterns:
          - "*"
+   cooldown:
+     default-days: 7
\ No newline at end of file
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 4422ed430..c9747b8ca 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -31,16 +31,16 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js 20
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 20
           cache: yarn
 
       - name: Set up uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
         with:
           python-version: '3.12'
           enable-cache: true
@@ -93,7 +93,7 @@ jobs:
             'release/Data-Formulator-macOS.zip'
 
       - name: Upload desktop artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ matrix.artifact }}
           path: release/*.zip
@@ -110,14 +110,14 @@ jobs:
 
     steps:
       - name: Download desktop artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: data-formulator-*
           path: release
           merge-multiple: true
 
       - name: Attach archives to GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           files: release/*.zip
           fail_on_unmatched_files: true
diff --git a/.github/workflows/python-build.yml b/.github/workflows/python-build.yml
index 1f5f7d7f5..b517491da 100644
--- a/.github/workflows/python-build.yml
+++ b/.github/workflows/python-build.yml
@@ -20,14 +20,14 @@ jobs:
     strategy:
       fail-fast: false
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Set Node.js 20
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: 20
         cache: 'yarn'
     - name: Set up uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7.6.0
       with:
         python-version: 3.12
     - name: Install node dependencies
@@ -39,7 +39,7 @@ jobs:
     - name: Validate python artifact
       run: uv run --with twine twine check dist/*
     - name: Archive production artifacts
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: release-dist
         path: dist
@@ -56,7 +56,7 @@ jobs:
       id-token: write
     steps:
       - name: Retrieve release distributions
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-dist
           path: dist/