diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c48305
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/auto-close-pr.yml b/.github/workflows/auto-close-pr.yml
index 22e2956..3017433 100644
--- a/.github/workflows/auto-close-pr.yml
+++ b/.github/workflows/auto-close-pr.yml
@@ -24,7 +24,7 @@ jobs:
           ASSOCIATION: ${{ github.event.pull_request.author_association }}
 
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: steps.free-pass.outputs.skip != 'true'
 
       - name: Check if user is vouched
@@ -41,7 +41,7 @@ jobs:
 
       - name: Comment and close PR
         if: steps.free-pass.outputs.skip != 'true' && steps.check.outputs.vouched == 'false'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const prNumber = context.payload.pull_request.number;
diff --git a/.github/workflows/block-pr.yml b/.github/workflows/block-pr.yml
index 0c4e4d0..04ca85c 100644
--- a/.github/workflows/block-pr.yml
+++ b/.github/workflows/block-pr.yml
@@ -21,7 +21,7 @@ jobs:
         env:
           ASSOCIATION: ${{ github.event.pull_request.author_association }}
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: steps.free-pass.outputs.skip != 'true'
 
       - name: Check vouched user
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 9cf7086..3a62d16 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -25,10 +25,10 @@ jobs:
         working-directory: docs
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: npm
@@ -39,13 +39,13 @@ jobs:
 
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
 
       - name: Build with Astro
         run: npx astro build
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: docs/dist
 
@@ -58,4 +58,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
\ No newline at end of file
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
\ No newline at end of file
diff --git a/.github/workflows/version-parity.yml b/.github/workflows/version-parity.yml
index 0387e22..d745aba 100644
--- a/.github/workflows/version-parity.yml
+++ b/.github/workflows/version-parity.yml
@@ -19,7 +19,7 @@ jobs:
     name: Check plugin version parity
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Compare versions across manifests
         run: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0cc828c..725b19a 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,7 @@ See `CONTRIBUTING.md` for full conventions.
 
 ### Changed
 
+- GitHub Actions now use full-length commit SHAs with release-version comments. Weekly grouped Dependabot updates for Actions use a seven-day cooldown for routine version updates.
 - Work item creation and decomposition now explicitly exclude invented sequential task and story identifiers from generated GitHub and Azure DevOps titles. The task quality rubric checks this convention while preserving feature prefixes, domain numbers, native board IDs, hierarchy, and dependency links. Existing work items are not renamed automatically.
 - The `test-discipline` skill now explicitly covers tautological assertions, independent behavioral oracles, and behavior-preserving refactoring. Implementation and review workers and the code quality rubric reinforce these checks. Reuse existing behavioral tests and add tests only for concrete coverage gaps, without requiring mutation-testing tooling or banning legitimate test helpers and computed expectations.