diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..5c5631448
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: monthly
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/update-lint-and-build.yml b/.github/workflows/update-lint-and-build.yml
index bcad11767..aee3563b0 100644
--- a/.github/workflows/update-lint-and-build.yml
+++ b/.github/workflows/update-lint-and-build.yml
@@ -16,10 +16,10 @@ jobs:
       matrix:
         version: [3.14, 3.13, 3.12, 3.11, '3.10']
     steps:
-      - uses: styfle/cancel-workflow-action@main
+      - uses: styfle/cancel-workflow-action@0.12.1
         with:
           access_token: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/setup-python@master
+      - uses: actions/setup-python@v6.0.0
         with:
           python-version: 3
       - name: Install dependencies
@@ -28,7 +28,7 @@ jobs:
           pip install requests cogapp polib transifex-python sphinx-intl blurb six
           curl -o- https://raw.githubusercontent.com/transifex/cli/master/install.sh | bash
         working-directory: /usr/local/bin
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5.0.0
         with:
           ref: ${{ matrix.version }}
           fetch-depth: 0
@@ -59,7 +59,7 @@ jobs:
       - run: git commit -m "$(python manage_translation.py generate_commit_msg)"
         if: env.SIGNIFICANT_CHANGES
       - name: Push commit
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@v1.0.0
         if: env.SIGNIFICANT_CHANGES
         with:
           branch: ${{ matrix.version }}
@@ -74,11 +74,11 @@ jobs:
     needs: ['update']
     continue-on-error: true
     steps:
-      - uses: actions/setup-python@master
+      - uses: actions/setup-python@v6.0.0
         with:
           python-version: 3
       - run: pip install sphinx-lint
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5.0.0
         with:
           ref: ${{ matrix.version }}
       - uses: rffontenelle/sphinx-lint-problem-matcher@v1.0.0
@@ -93,16 +93,16 @@ jobs:
         format: [html, latex, epub]
     needs: ['update']
     steps:
-      - uses: actions/setup-python@master
+      - uses: actions/setup-python@v6.0.0
         with:
           python-version: 3.12  # pin for Sphinx 3.4.3 in 3.10 branch (see #63)
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5.0.0
         with:
           repository: python/cpython
           ref: ${{ matrix.version }}
       - run: make venv
         working-directory: ./Doc
-      - uses: actions/checkout@master
+      - uses: actions/checkout@v5.0.0
         with:
           ref: ${{ matrix.version }}
           path: Doc/locales/pl/LC_MESSAGES
@@ -111,7 +111,7 @@ jobs:
       - uses: sphinx-doc/github-problem-matcher@v1.1
       - run: make -e SPHINXOPTS="--color -D language='pl' -W --keep-going" ${{ matrix.format }}
         working-directory: ./Doc
-      - uses: actions/upload-artifact@master
+      - uses: actions/upload-artifact@v5.0.0
         if: success() || failure()
         with:
           name: build-${{ matrix.version }}-${{ matrix.format }}
@@ -124,13 +124,13 @@ jobs:
         version: [3.14, 3.13, 3.12, 3.11, '3.10']
     needs: ['build']
     steps:
-      - uses: actions/download-artifact@master
+      - uses: actions/download-artifact@v6.0.0
         with:
           name: build-${{ matrix.version }}-latex
       - run: sudo apt-get update
       - run: sudo apt-get install -y latexmk texlive-xetex fonts-freefont-otf xindy
       - run: make
-      - uses: actions/upload-artifact@master
+      - uses: actions/upload-artifact@v5.0.0
         with:
           name: build-${{ matrix.version }}-pdf
           path: .
@@ -147,7 +147,7 @@ jobs:
         with:
           python-version: 3.x
       - uses: astral-sh/setup-uv@v5
-      - uses: actions/download-artifact@master
+      - uses: actions/download-artifact@v6.0.0
         with:
           name: build-${{ matrix.version }}-epub
       - run: uvx epubcheck