diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 03ae7e6..591367c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -16,6 +16,8 @@ updates:
       gha:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
   - package-ecosystem: gomod
     directory: /
     schedule:
@@ -33,6 +35,8 @@ updates:
       gomod:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
   - package-ecosystem: docker
     directory: /
     schedule:
@@ -47,3 +51,5 @@ updates:
       docker:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/lint_gha.yml b/.github/workflows/lint_gha.yml
new file mode 100644
index 0000000..3077ac9
--- /dev/null
+++ b/.github/workflows/lint_gha.yml
@@ -0,0 +1,30 @@
+---
+name: Linting - GitHub Actions
+permissions: {}
+on:
+  push:
+    branches: [master]
+    paths:
+      - ".github/workflows/*.yml"
+      - ".github/dependabot.yml"
+  pull_request:
+    branches: [master]
+    paths:
+      - ".github/workflows/*.yml"
+      - ".github/dependabot.yml"
+
+jobs:
+  lint-gha:
+    name: Lint GitHub Actions
+    timeout-minutes: 5
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
diff --git a/.github/workflows/lint_go.yml b/.github/workflows/lint_go.yml
index 091cc07..3c78b0c 100644
--- a/.github/workflows/lint_go.yml
+++ b/.github/workflows/lint_go.yml
@@ -1,5 +1,6 @@
 ---
 name: Linting - Go
+permissions: {}
 # Split until path filtering for jobs added
 # https://github.community/t/path-filtering-for-jobs-and-steps/16447
 on:
@@ -22,7 +23,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Run golangci-lint
-        uses: reviewdog/action-golangci-lint@v2
+        uses: reviewdog/action-golangci-lint@c76cceaaab89abe74e649d2e34c6c9adc26662d2 # v2.10.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b8ae46..05707d7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,5 +1,6 @@
 ---
 name: Release
+permissions: {}
 on:
   # https://github.com/actions/runner/issues/1007
   push:
@@ -10,17 +11,22 @@ jobs:
   release:
     name: Release on GitHub
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # Required for GoReleaser to create releases and upload assets.
     steps:
       - name: Check out code
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
+          cache: false
 
       - name: Launch goreleaser
-        uses: goreleaser/goreleaser-action@v6.4.0
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6.4.0
         with:
           args: release
         env:
diff --git a/.github/workflows/release_containers.yml b/.github/workflows/release_containers.yml
index 60145a9..c2c55ed 100644
--- a/.github/workflows/release_containers.yml
+++ b/.github/workflows/release_containers.yml
@@ -1,5 +1,6 @@
 ---
 name: Release Containers
+permissions: {}
 on:
   # https://github.com/actions/runner/issues/1007
   push:
@@ -21,20 +22,14 @@ jobs:
             suffix: -alpine
 
     steps:
-      - name: Cache container layers
-        uses: actions/cache@v4.3.0
-        with:
-          path: /tmp/.buildx-cache
-          key: ${{ runner.os }}${{ matrix.containers.suffix }}-buildx-${{ github.sha }}
-          restore-keys: |
-            ${{ runner.os }}${{ matrix.containers.suffix }}-buildx-
-
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Generate container tags and labels
         id: docker_meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: controlplane/badrobot
           tags: |
@@ -47,7 +42,7 @@ jobs:
             org.opencontainers.image.vendor=controlplane
 
       - name: Login to Docker Hub Registry
-        uses: docker/login-action@v3.6.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: docker.io
           username: ${{ secrets.DOCKERHUB_USERNAME }}
@@ -61,20 +56,18 @@ jobs:
       #     password: ${{ secrets.CR_PAT }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
       - name: Set up Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build container and push tags
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           platforms: linux/amd64,linux/arm64
           push: ${{ github.event_name != 'pull_request' }}
           file: ${{ matrix.containers.file }}
-          cache-from: type=local,src=/tmp/.buildx-cache
-          cache-to: mode=max,type=local,dest=/tmp/.buildx-cache
           tags: ${{ steps.docker_meta.outputs.tags }}
           labels: ${{ steps.docker_meta.outputs.labels }}
           build-args: |
diff --git a/.github/workflows/security_analysis.yml b/.github/workflows/security_analysis.yml
index b2e5d4c..bad9a3f 100644
--- a/.github/workflows/security_analysis.yml
+++ b/.github/workflows/security_analysis.yml
@@ -1,6 +1,6 @@
 ---
 name: Security Analysis
-
+permissions: {}
 on:
   push:
     branches: [master]
@@ -27,16 +27,18 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@3ea06614dafe36dec890db3446326e0d40ce53d4 # v3.38.1
         with:
           languages: go
 
       # analyzes + uploads sarif
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@3ea06614dafe36dec890db3446326e0d40ce53d4 # v3.38.1
 
   govulncheck:
     name: govulncheck
@@ -46,10 +48,12 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Vulnerability Scan Go Code
-        uses: golang/govulncheck-action@v1
+        uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
         with:
           go-version-file: go.mod
           repo-checkout: false
@@ -65,7 +69,7 @@ jobs:
           cat <<< $(jq '(.runs[] | select(.results == null) | .results) |= []' govulncheck.sarif) > govulncheck.sarif
 
       - name: Upload Scan SARIF file
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@3ea06614dafe36dec890db3446326e0d40ce53d4 # v3.38.1
         with:
           sarif_file: govulncheck.sarif
           category: govulncheck
diff --git a/.github/workflows/test_acceptance.yml b/.github/workflows/test_acceptance.yml
index fbebf5f..20a9c0f 100644
--- a/.github/workflows/test_acceptance.yml
+++ b/.github/workflows/test_acceptance.yml
@@ -1,5 +1,6 @@
 ---
 name: Testing - Acceptance
+permissions: {}
 # Split until path filtering for jobs added
 # https://github.community/t/path-filtering-for-jobs-and-steps/16447
 on:
@@ -26,13 +27,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
+          persist-credentials: false
           # needed for bats tests
           submodules: true
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         id: go
         with:
           go-version-file: go.mod
diff --git a/.github/workflows/test_unit.yml b/.github/workflows/test_unit.yml
index d4b9536..2e2de88 100644
--- a/.github/workflows/test_unit.yml
+++ b/.github/workflows/test_unit.yml
@@ -1,5 +1,6 @@
 ---
 name: Testing - Unit
+permissions: {}
 # Split until path filtering for jobs added
 # https://github.community/t/path-filtering-for-jobs-and-steps/16447
 on:
@@ -22,10 +23,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod