diff --git a/.github/actions/GetGitBranches/action.yaml b/.github/actions/GetGitBranches/action.yaml
index e5476da0c40..36c520c58eb 100644
--- a/.github/actions/GetGitBranches/action.yaml
+++ b/.github/actions/GetGitBranches/action.yaml
@@ -18,7 +18,7 @@ runs:
   using: composite
   steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: run
       shell: pwsh
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index a9141bf5fcf..9dfb9a63f1f 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,4 +15,6 @@ updates:
     - dependency-name: "microsoft/AL-Go-Actions/*"
     - dependency-name: "microsoft/AL-Go/*"
   labels:
-    - "Automation"
\ No newline at end of file
+    - "Automation"
+  cooldown:
+    default-days: 7
\ No newline at end of file
diff --git a/.github/workflows/ai-triage-dispatch.yml b/.github/workflows/ai-triage-dispatch.yml
index 92a43b29d41..3ed7babf5f2 100644
--- a/.github/workflows/ai-triage-dispatch.yml
+++ b/.github/workflows/ai-triage-dispatch.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: Mint token for the agent repo
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           app-id: ${{ vars.TRIAGE_APP_ID }}
           private-key: ${{ secrets.TRIAGE_APP_PRIVATE_KEY }}
@@ -130,7 +130,7 @@ jobs:
 
       - name: Apply triage result
         if: steps.download.outputs.have_result == 'true'
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -172,7 +172,7 @@ jobs:
 
       - name: Report triage failure
         if: always() && (steps.await.outputs.run_id == '' || steps.download.outputs.have_result == 'false')
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             await github.rest.issues.createComment({
diff --git a/.github/workflows/ownership-classification.yml b/.github/workflows/ownership-classification.yml
index 0a5445934d3..46cc8d9cb87 100644
--- a/.github/workflows/ownership-classification.yml
+++ b/.github/workflows/ownership-classification.yml
@@ -70,7 +70,7 @@ jobs:
 
       - name: Check labels and manual override
         id: preflight
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           SUBJECT_KIND: ${{ env.SUBJECT_KIND }}
           SUBJECT_NUMBER: ${{ env.SUBJECT_NUMBER }}
@@ -162,7 +162,7 @@ jobs:
       - name: Create correlation token
         if: steps.preflight.outputs.dispatch == 'true'
         id: correlation
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: core.setOutput('token', require('crypto').randomUUID())
 
@@ -232,7 +232,7 @@ jobs:
 
       - name: Validate and apply ownership result
         if: steps.preflight.outputs.dispatch == 'true'
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           RESULT_PATH: result/ownership-result.json
           CORRELATION_TOKEN: ${{ steps.correlation.outputs.token }}