diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..d47e57c290
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      actions-minor-patch:
+        update-types: ["minor", "patch"]
+    commit-message:
+      prefix: "ci"
+    ignore:
+      # Deliberately held at v1.8.2: 7c776462 switched deploy.yml to
+      # actions/create-github-app-token@v2, 5c2520c4 reverted it three days later.
+      - dependency-name: "tibdex/github-app-token"
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index ab080487a5..bae03f0f22 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -9,8 +9,8 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22.12.0'
           cache: 'npm'
@@ -29,7 +29,7 @@ jobs:
         if: steps.files.outputs.any_changed == 'true'
         run: npm install
       - name: check if files are crlf
-        uses: kforeverisback/check-crlf-extended@v2
+        uses: kforeverisback/check-crlf-extended@bb2dea99a7da756525ede285d33811e5552d3ceb # v2
         continue-on-error: false
         with:
           directory: ./data
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 8b8d9c993e..13aa7b01e7 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -10,21 +10,21 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: tibdex/github-app-token@v1.8.2
+      - uses: tibdex/github-app-token@0d49dd721133f900ebd5e0dff2810704e8defbc6 # v1.8.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
           app_id: ${{ secrets.APP_ID }}
           private_key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ env.ACT }}
         with:
           token: ${{ github.token }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ !env.ACT }}
         with:
           token: ${{ steps.create-app-token.outputs.token }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22.12.0'
           cache: 'npm'
@@ -32,7 +32,7 @@ jobs:
         run: npm install
       - name: export data to ./api
         run: npm run db:export
-      - uses: JamesIves/github-pages-deploy-action@4.1.1
+      - uses: JamesIves/github-pages-deploy-action@164583b9e44b4fc5910e78feb607ea7c98d3c7b9 # 4.1.1
         if: ${{ !env.ACT && github.ref == 'refs/heads/master' }}
         with:
           repository-name: iptv-org/api
diff --git a/.github/workflows/update.yml b/.github/workflows/update.yml
index af3a04b822..089acc81f4 100644
--- a/.github/workflows/update.yml
+++ b/.github/workflows/update.yml
@@ -9,21 +9,21 @@ jobs:
   main:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ env.ACT }}
         with:
           token: ${{ github.token }}
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         if: ${{ !env.ACT }}
         with:
           token: ${{ steps.create-app-token.outputs.token }}
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '22.12.0'
           cache: 'npm'
@@ -37,7 +37,7 @@ jobs:
       - name: validate changes
         run: npm run db:validate
       - name: check if files are crlf
-        uses: kforeverisback/check-crlf-extended@v2
+        uses: kforeverisback/check-crlf-extended@bb2dea99a7da756525ede285d33811e5552d3ceb # v2
         continue-on-error: false
         with:
           directory: ./data
diff --git a/.github/workflows/validate_issue.yml b/.github/workflows/validate_issue.yml
index be9abb40fa..05e05e5e47 100644
--- a/.github/workflows/validate_issue.yml
+++ b/.github/workflows/validate_issue.yml
@@ -17,9 +17,9 @@ jobs:
       contains(join(github.event.issue.labels.*.name, ','), 'blocklist:')
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with:
@@ -27,7 +27,7 @@ jobs:
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: 22
           cache: 'npm'
diff --git a/.github/workflows/validate_label.yml b/.github/workflows/validate_label.yml
index 853242139e..917701c872 100644
--- a/.github/workflows/validate_label.yml
+++ b/.github/workflows/validate_label.yml
@@ -12,9 +12,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/create-github-app-token@v2
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         if: ${{ !env.ACT }}
         id: create-app-token
         with: