diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5c97f13
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+# Workflows pin third-party actions to commit SHAs; this keeps those pins
+# current in one grouped PR a month
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 08137b3..e960c26 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
       # monty 1.1.0 needs a newer std than the runner image's toolchain
       - name: Update Rust
         run: rustup update stable --no-self-update && rustup default stable && rustup component add clippy rustfmt
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
       # the gateway tests run scripts in the Monty worker the lock file pins,
       # and fail rather than skip without it
       - name: Monty worker version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75c11d5..bddc261 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -37,7 +37,7 @@ jobs:
           test "$GITHUB_REF_NAME" = "v$version" || { echo "tag $GITHUB_REF_NAME does not match version $version"; exit 1; }
       # a draft until the archive is attached: `update` follows
       # releases/latest, which would otherwise point at a release with no assets
-      - uses: taiki-e/create-gh-release-action@v1
+      - uses: taiki-e/create-gh-release-action@eba8ea96c86cca8a37f1b56e94b4d13301fba651 # v1.11.0
         with:
           draft: true