diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..2c48305b7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/catnap.yml b/.github/workflows/catnap.yml
index 679ead37e..724ecee4c 100644
--- a/.github/workflows/catnap.yml
+++ b/.github/workflows/catnap.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -64,7 +64,7 @@ jobs:
           --client-addr $CLIENT_ADDR
     - name: Archive Logs
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catnap-debug-pipeline-logs
         path: |
@@ -81,7 +81,7 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -116,7 +116,7 @@ jobs:
     - name: Archive Logs
       if: always()
       continue-on-error: true
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catnap-release-pipeline-logs
         path: |
@@ -140,12 +140,12 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Download Release Pipeline Logs
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: catnap-release-pipeline-logs
         path: ./catnap_release_pipeline_logs
@@ -165,7 +165,7 @@ jobs:
           --log-dir ./catnap_release_pipeline_logs)
     - name: Archive Performance Data
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: performance-data
         path: |
diff --git a/.github/workflows/catnapw.yml b/.github/workflows/catnapw.yml
index b93bbf4f3..90cab88cf 100644
--- a/.github/workflows/catnapw.yml
+++ b/.github/workflows/catnapw.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -65,7 +65,7 @@ jobs:
           --client-addr $CLIENT_ADDR
     - name: Archive Logs
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catnapw-debug-pipeline-logs
         path: |
@@ -82,7 +82,7 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -118,7 +118,7 @@ jobs:
     - name: Archive Logs
       if: always()
       continue-on-error: true
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catnapw-release-pipeline-logs
         path: |
@@ -131,7 +131,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -165,7 +165,7 @@ jobs:
           --client-addr $CLIENT_ADDR
     - name: Archive Logs
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catpowder-debug-pipeline-logs
         path: |
@@ -182,7 +182,7 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -218,7 +218,7 @@ jobs:
     - name: Archive Logs
       if: always()
       continue-on-error: true
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catpowder-release-pipeline-logs
         path: |
diff --git a/.github/workflows/catnip.yml b/.github/workflows/catnip.yml
index 299aee95f..2e4e50e46 100644
--- a/.github/workflows/catnip.yml
+++ b/.github/workflows/catnip.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -86,7 +86,7 @@ jobs:
           --client-addr $CLIENT_ADDR
     - name: Archive Logs
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catnip-debug-pipeline-logs
         path: |
@@ -103,7 +103,7 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -161,7 +161,7 @@ jobs:
     - name: Archive Logs
       if: always()
       continue-on-error: true
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catnip-release-pipeline-logs
         path: |
@@ -185,12 +185,12 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Download Release Pipeline Logs
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: catnip-release-pipeline-logs
         path: ./catnip_release_pipeline_logs
@@ -210,7 +210,7 @@ jobs:
           --log-dir ./catnip_release_pipeline_logs)
     - name: Archive Performance Data
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: performance-data
         path: |
diff --git a/.github/workflows/catpowder.yml b/.github/workflows/catpowder.yml
index 57511af91..91dc49d62 100644
--- a/.github/workflows/catpowder.yml
+++ b/.github/workflows/catpowder.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -82,7 +82,7 @@ jobs:
           --client-addr $CLIENT_ADDR
     - name: Archive Logs
       if: always()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catpowder-debug-pipeline-logs
         path: |
@@ -99,7 +99,7 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Setup SSH
@@ -153,7 +153,7 @@ jobs:
     - name: Archive Logs
       if: always()
       continue-on-error: true
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: catpowder-release-pipeline-logs
         path: |
@@ -177,12 +177,12 @@ jobs:
       run: echo "Release pipeline skipped because branch is not main, unstable, dev, or does not contain 'do-release'."
     - name: Checkout
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
     - name: Download Release Pipeline Logs
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: catpowder-release-pipeline-logs
         path: ./catpowder_release_pipeline_logs
@@ -202,7 +202,7 @@ jobs:
           --log-dir ./catpowder_release_pipeline_logs)
     - name: Archive Performance Data
       if: ${{ env.SHOULD_RUN_RELEASE == 'true' }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: performance-data
         path: |