diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2c231e5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    cooldown:
+      default-days: 7
+    directories:
+      - "/"
+    schedule:
+      interval: weekly
+    groups:
+      minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    open-pull-requests-limit: 50
diff --git a/.github/workflows/release-skills.yml b/.github/workflows/release-skills.yml
index 195c72e..e459a9d 100644
--- a/.github/workflows/release-skills.yml
+++ b/.github/workflows/release-skills.yml
@@ -11,6 +11,9 @@ on:
         type: boolean
         default: true
 
+permissions:
+  contents: read
+
 jobs:
   release:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/verify-skills.yml b/.github/workflows/verify-skills.yml
index 550ac0d..5318989 100644
--- a/.github/workflows/verify-skills.yml
+++ b/.github/workflows/verify-skills.yml
@@ -2,32 +2,19 @@ name: Verify skills
 
 on:
   pull_request:
-    paths:
-      - "skills/**"
-      - ".maintainer/**"
-      - "VERSION"
-      - "skills.sh.json"
-      - ".claude-plugin/**"
-      - "Makefile"
-      - ".github/workflows/verify-skills.yml"
   push:
     branches: [main]
-    paths:
-      - "skills/**"
-      - ".maintainer/**"
-      - "VERSION"
-      - "skills.sh.json"
-      - ".claude-plugin/**"
-      - "Makefile"
-      - ".github/workflows/verify-skills.yml"
+
+permissions:
+  contents: read
 
 jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: "22"