diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..773fa24
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+version: 2
+updates:
+    - package-ecosystem: "github-actions"
+      directory: "/"
+      schedule:
+          interval: "weekly"
+      rebase-strategy: "auto"
+      open-pull-requests-limit: 3
+      groups:
+          minor-and-patch:
+               update-types:
+                   - "minor"
+                   - "patch"
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index bc00ac8..ffd7441 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -17,12 +17,13 @@ jobs:
         runs-on: ubuntu-latest
         timeout-minutes: 15
         steps:
-            - uses: actions/checkout@v5
+            - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
               with:
                   fetch-depth: 0
                   submodules: 1
+                  persist-credentials: false
 
-            - uses: shivammathur/setup-php@v2
+            - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
               with:
                   php-version: 8.5
                   tools: composer:v2
diff --git a/.gitignore b/.gitignore
index c1d3cd3..a5c554e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 .DS_Store
 .idea
+.claude/settings.local.json
 composer.lock
 /vendor/