diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c48305
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-and-draft-release.yml b/.github/workflows/build-and-draft-release.yml
index 738d99f..a9d8a77 100644
--- a/.github/workflows/build-and-draft-release.yml
+++ b/.github/workflows/build-and-draft-release.yml
@@ -36,7 +36,7 @@ jobs:
         working-directory: build
     steps:
       - uses: actions/checkout@main
-      - uses: hashicorp/setup-terraform@v2
+      - uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2.0.3
 
       - name: Build workbook by Terraform
         run: make all
@@ -45,7 +45,7 @@ jobs:
         run: ls -lR
 
       - name: Upload workbook files
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5 # v3.2.1
         with:
           name: asset
           path: |
@@ -61,7 +61,7 @@ jobs:
     needs: build-and-attach
     steps:
       # Drafts your next Release notes as Pull Requests are merged into "master"
-      - uses: release-drafter/release-drafter@v5
+      - uses: release-drafter/release-drafter@09c613e259eb8d4e7c81c2cb00618eb5fc4575a7 # v5.25.0
         id: release_drafter
         # (Optional) specify config name to use, relative to .github/. Default: release-drafter.yml
         # with:
@@ -71,7 +71,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Generate token
         id: generate_token
-        uses: tibdex/github-app-token@v1
+        uses: tibdex/github-app-token@32691ba7c9e7063bd457bd8f2a5703138591fa58 # v1.9.0
         with:
           app_id: ${{ secrets.FOR_COMMIT_BOT_APP_ID }}
           private_key: ${{ secrets.FOR_COMMIT_BOT_PRIVATE_KEY }}
@@ -80,10 +80,10 @@ jobs:
         with:
           token: ${{steps.generate_token.outputs.token}}
       - name: Download asset
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
       - name: Display structure of downloaded files
         run: ls -lR
-      - uses: shogo82148/actions-upload-release-asset@v1
+      - uses: shogo82148/actions-upload-release-asset@aaba0f56bdbc1071f4af234d5cb16055e8a400de # v1.10.4
         with:
           upload_url: ${{ steps.release_drafter.outputs.upload_url }}
           asset_path: |
@@ -92,7 +92,7 @@ jobs:
       - name: Move files from asset to workbooks directory
         run: |
           mv -f asset/* workbooks/
-      - uses: EndBug/add-and-commit@v9.0.1
+      - uses: EndBug/add-and-commit@998652d28d7702d095d40f52ae42982a80ae8c7d # v9.0.1
         with:
           author_name: github-actions
           author_email: '41898282+github-actions[bot]@users.noreply.github.com'