diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..d98e54a1
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,13 @@
+# This file is used by GitHub Dependabot to manage dependencies in the project.
+
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: daily
diff --git a/.github/workflows/ossf-scoreboard.yml b/.github/workflows/ossf-scoreboard.yml
index 9b69a86a..537a8e55 100644
--- a/.github/workflows/ossf-scoreboard.yml
+++ b/.github/workflows/ossf-scoreboard.yml
@@ -7,6 +7,10 @@ on:
   branch_protection_rule:
   schedule:
     - cron: '32 4 * * 5'
+  pull_request:
+    branches: [ "main" ]
+    paths-ignore:
+      - .github/workflows/ossf-scoreboard.yml
   push:
     branches: [ "main" ]
 
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 737362b0..54b667cb 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -1,43 +1,42 @@
----
-  name: trivy
+name: trivy
 
-  on:
-    pull_request:
-      types: [ 'opened', 'reopened', 'synchronize' ]
-    merge_group:
-    workflow_dispatch:
+on:
+  pull_request:
+    types: [ 'opened', 'reopened', 'synchronize' ]
+  merge_group:
+  workflow_dispatch:
 
+permissions: read-all
 
-  permissions:
-    actions: read
-    contents: read
-    security-events: write
+jobs:
+  build:
+    name: 'trivy scan'
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
 
-  jobs:
-    build:
-      name: 'trivy scan'
-      runs-on: ubuntu-latest
-      steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
-        with:
-          egress-policy: audit
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@4d991eb9b905ef189e4c376166672c3f2f230481 # v2.11.0
+      with:
+        egress-policy: audit
 
-      - name: Checkout code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - name: Checkout code
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Run Trivy vulnerability scanner (file system)
-        uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
-        with:
-          scan-type: 'fs'
-          ignore-unfixed: true
-          scan-ref: .
-          format: 'sarif'
-          scanners: 'vuln,secret,config'
-          output: report-fs.sarif
+    - name: Run Trivy vulnerability scanner (file system)
+      uses: aquasecurity/trivy-action@18f2510ee396bbf400402947b394f2dd8c87dbb0 # 0.29.0
+      with:
+        scan-type: 'fs'
+        ignore-unfixed: true
+        scan-ref: .
+        format: 'sarif'
+        scanners: 'vuln,secret,config'
+        output: report-fs.sarif
 
-      - name: Upload Trivy report (fs) GitHub Security
-        uses: github/codeql-action/upload-sarif@d68b2d4edb4189fd2a5366ac14e72027bd4b37dd # v3.28.2
-        with:
-          sarif_file: report-fs.sarif
-          category: 'fs'
+    - name: Upload Trivy report (fs) GitHub Security
+      uses: github/codeql-action/upload-sarif@9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 # v3.28.9
+      with:
+        sarif_file: report-fs.sarif
+        category: 'fs'