diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ae8d3f3..328ae39 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +1,16 @@
 version: 2
 updates:
-  # Maintain dependencies for GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "quarterly"
+    groups:
+      coatl-dev-actions:
+        patterns:
+          - "coatl-dev/actions/**"
+      coatl-dev-workflows:
+        patterns:
+          - "coatl-dev/workflows/**"
     labels: ["dependencies"]
     commit-message:
       prefix: "ci"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1ca75e0..d795694 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -8,10 +8,10 @@ on:
 
 jobs:
   pylint:
-    uses: coatl-dev/workflows/.github/workflows/pylint.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/pylint.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
     with:
       path: src
 
   tox:
     if: ${{ github.event_name == 'pull_request' }}
-    uses: ./.github/workflows/tox.yml
+    uses: $/.github/workflows/tox.yml
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ff04c32..27c95ba 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -7,22 +7,22 @@ on:
 
 jobs:
   tox:
-    uses: ./.github/workflows/tox.yml
+    uses: $/.github/workflows/tox.yml
 
   pypi-upload:
     needs: tox
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Upload package to PyPI
-        uses: coatl-dev/actions/pypi-upload@v5
+        uses: coatl-dev/actions/pypi-upload@45ee24a8c8397a346538acefea6221e30076fa66 # v7.0.14
         with:
           password: ${{ secrets.PYPI_API_TOKEN_JAVA_API_PKG }}
 
       - name: Upload stubs to PyPI
-        uses: coatl-dev/actions/pypi-upload@v5
+        uses: coatl-dev/actions/pypi-upload@45ee24a8c8397a346538acefea6221e30076fa66 # v7.0.14
         with:
           python-version: '3.12'
           password: ${{ secrets.PYPI_API_TOKEN_JAVA_API_STUBS }}
diff --git a/.github/workflows/tox.yml b/.github/workflows/tox.yml
index 30b12ff..dcab48d 100644
--- a/.github/workflows/tox.yml
+++ b/.github/workflows/tox.yml
@@ -5,10 +5,10 @@ on:
 
 jobs:
   tox-package:
-    uses: coatl-dev/workflows/.github/workflows/tox-docker.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/tox-docker.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
 
   tox-stubs:
-    uses: coatl-dev/workflows/.github/workflows/tox.yml@v6
+    uses: coatl-dev/workflows/.github/workflows/tox.yml@0d24a98543a7e17f432503425e6ef836972864bb # v7.0.28
     with:
       python-versions: |
         3.9