diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3841c705e93c6..fb98ffaf2c864 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,10 +4,11 @@ version: 2
 updates:
   - package-ecosystem: "github-actions" # Core GitHub Actions
     directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "wednesday"
-    open-pull-requests-limit: 10
     cooldown:
      default-days: 7
   - package-ecosystem: "nuget"
diff --git a/.github/workflows/check-for-build-warnings.yml b/.github/workflows/check-for-build-warnings.yml
index d001d9373037b..e428a523708eb 100644
--- a/.github/workflows/check-for-build-warnings.yml
+++ b/.github/workflows/check-for-build-warnings.yml
@@ -20,6 +20,6 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: dotnet/docs-tools/actions/status-checker@main
+      - uses: dotnet/docs-tools/actions/status-checker@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/cleanrepo-orphaned-articles.yml b/.github/workflows/cleanrepo-orphaned-articles.yml
index 2c818618064ef..955970cd47f6a 100644
--- a/.github/workflows/cleanrepo-orphaned-articles.yml
+++ b/.github/workflows/cleanrepo-orphaned-articles.yml
@@ -26,7 +26,7 @@ jobs:
       # Call clean repo
       - name: Clean repo
         id: clean-repo-step
-        uses: dotnet/docs-tools/cleanrepo@main
+        uses: dotnet/docs-tools/cleanrepo@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           function: "FindOrphanedArticles"
           docfx_directory: "."
diff --git a/.github/workflows/cleanrepo-orphaned-images.yml b/.github/workflows/cleanrepo-orphaned-images.yml
index b8cf8fe24b47c..6a5a314e99a0b 100644
--- a/.github/workflows/cleanrepo-orphaned-images.yml
+++ b/.github/workflows/cleanrepo-orphaned-images.yml
@@ -26,7 +26,7 @@ jobs:
       # Call clean repo
       - name: Clean repo
         id: clean-repo-step
-        uses: dotnet/docs-tools/cleanrepo@main
+        uses: dotnet/docs-tools/cleanrepo@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           function: "FindOrphanedImages"
           docfx_directory: "."
diff --git a/.github/workflows/cleanrepo-orphaned-includes.yml b/.github/workflows/cleanrepo-orphaned-includes.yml
index d705c0acad1ec..74f8b41d08cdb 100644
--- a/.github/workflows/cleanrepo-orphaned-includes.yml
+++ b/.github/workflows/cleanrepo-orphaned-includes.yml
@@ -26,7 +26,7 @@ jobs:
       # Call clean repo
       - name: Clean repo
         id: clean-repo-step
-        uses: dotnet/docs-tools/cleanrepo@main
+        uses: dotnet/docs-tools/cleanrepo@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           function: "FindOrphanedIncludes"
           docfx_directory: "."
diff --git a/.github/workflows/cleanrepo-orphaned-snippets.yml b/.github/workflows/cleanrepo-orphaned-snippets.yml
index a8f6c663aa0d0..989e738b87635 100644
--- a/.github/workflows/cleanrepo-orphaned-snippets.yml
+++ b/.github/workflows/cleanrepo-orphaned-snippets.yml
@@ -26,7 +26,7 @@ jobs:
       # Call clean repo
       - name: Clean repo
         id: clean-repo-step
-        uses: dotnet/docs-tools/cleanrepo@main
+        uses: dotnet/docs-tools/cleanrepo@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           function: "FindOrphanedSnippets"
           docfx_directory: "."
diff --git a/.github/workflows/cleanrepo-redirect-hops.yml b/.github/workflows/cleanrepo-redirect-hops.yml
index 56d1aa78fef2a..4cabeb90e28a4 100644
--- a/.github/workflows/cleanrepo-redirect-hops.yml
+++ b/.github/workflows/cleanrepo-redirect-hops.yml
@@ -26,7 +26,7 @@ jobs:
       # Call clean repo
       - name: Clean repo
         id: clean-repo-step
-        uses: dotnet/docs-tools/cleanrepo@main
+        uses: dotnet/docs-tools/cleanrepo@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           function: "RemoveRedirectHops"
           docfx_directory: "."
diff --git a/.github/workflows/cleanrepo-relative-links.yml b/.github/workflows/cleanrepo-relative-links.yml
index 62100bed464fd..382d3f26a6fab 100644
--- a/.github/workflows/cleanrepo-relative-links.yml
+++ b/.github/workflows/cleanrepo-relative-links.yml
@@ -26,7 +26,7 @@ jobs:
       # Call clean repo
       - name: Clean repo
         id: clean-repo-step
-        uses: dotnet/docs-tools/cleanrepo@main
+        uses: dotnet/docs-tools/cleanrepo@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           function: "ReplaceWithRelativeLinks"
           docfx_directory: "."
diff --git a/.github/workflows/cleanrepo-replace-redirects.yml b/.github/workflows/cleanrepo-replace-redirects.yml
index 9228f2856cc04..1b342bf78ca50 100644
--- a/.github/workflows/cleanrepo-replace-redirects.yml
+++ b/.github/workflows/cleanrepo-replace-redirects.yml
@@ -26,7 +26,7 @@ jobs:
       # Call clean repo
       - name: Clean repo
         id: clean-repo-step
-        uses: dotnet/docs-tools/cleanrepo@main
+        uses: dotnet/docs-tools/cleanrepo@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           function: "ReplaceRedirectTargets"
           docfx_directory: "."
diff --git a/.github/workflows/dependabot-bot.yml b/.github/workflows/dependabot-bot.yml
index f2e84c0070f1a..6d895a95fe83b 100644
--- a/.github/workflows/dependabot-bot.yml
+++ b/.github/workflows/dependabot-bot.yml
@@ -46,7 +46,7 @@ jobs:
       # Run the .NET dependabot-bot tool
       - name: dependabot-bot
         id: dependabot-bot
-        uses: dotnet/docs-tools/actions/dependabot-bot@main
+        uses: dotnet/docs-tools/actions/dependabot-bot@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/docs-verifier.yml b/.github/workflows/docs-verifier.yml
index 4d6f5cb88a345..369bd8787fa99 100644
--- a/.github/workflows/docs-verifier.yml
+++ b/.github/workflows/docs-verifier.yml
@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Validate
-        uses: dotnet/docs-tools/actions/docs-verifier@main
+        uses: dotnet/docs-tools/actions/docs-verifier@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ops-build-reporter.yml b/.github/workflows/ops-build-reporter.yml
index 1320746324154..7003826beddef 100644
--- a/.github/workflows/ops-build-reporter.yml
+++ b/.github/workflows/ops-build-reporter.yml
@@ -21,7 +21,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: dotnet/docs-tools/actions/ops-build-reporter@main
+      - uses: dotnet/docs-tools/actions/ops-build-reporter@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           annotate_file_warnings: true
diff --git a/.github/workflows/quest-bulk.yml b/.github/workflows/quest-bulk.yml
index 91b7b2b2b0e36..f80912449af19 100644
--- a/.github/workflows/quest-bulk.yml
+++ b/.github/workflows/quest-bulk.yml
@@ -41,7 +41,7 @@ jobs:
 
       - name: Azure OpenID Connect
         id: azure-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -49,7 +49,7 @@ jobs:
 
       - name: Azure DevOps OpenID Connect
         id: azure-devops-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -57,7 +57,7 @@ jobs:
 
       - name: bulk-sequester
         id: bulk-sequester
-        uses: dotnet/docs-tools/actions/sequester@main
+        uses: dotnet/docs-tools/actions/sequester@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__QuestAccessToken: ${{ steps.azure-devops-oidc-auth.outputs.access-token }}
diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml
index 603130795390b..673238eda0b56 100644
--- a/.github/workflows/quest.yml
+++ b/.github/workflows/quest.yml
@@ -44,7 +44,7 @@ jobs:
 
       - name: Azure OpenID Connect
         id: azure-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -52,7 +52,7 @@ jobs:
 
       - name: Azure DevOps OpenID Connect for manual test runs
         id: azure-devops-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -63,7 +63,7 @@ jobs:
       - name: manual-sequester
         if: ${{ github.event_name == 'workflow_dispatch' }}
         id: manual-sequester
-        uses: dotnet/docs-tools/actions/sequester@main
+        uses: dotnet/docs-tools/actions/sequester@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }}
@@ -79,7 +79,7 @@ jobs:
       - name: auto-sequester
         if: ${{ github.event_name != 'workflow_dispatch' }}
         id: auto-sequester
-        uses: dotnet/docs-tools/actions/sequester@main
+        uses: dotnet/docs-tools/actions/sequester@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }}
diff --git a/.github/workflows/version-sweep.yml b/.github/workflows/version-sweep.yml
index 4c5fb085459b2..815c84b18d0c9 100644
--- a/.github/workflows/version-sweep.yml
+++ b/.github/workflows/version-sweep.yml
@@ -40,7 +40,7 @@ jobs:
 
             - name: .NET version updater
               id: dotnet-version-updater
-              uses: dotnet/docs-tools/actions/dotnet-version-updater@main
+              uses: dotnet/docs-tools/actions/dotnet-version-updater@78c0756b60e5046dd55295c4a9369b20ffad6b34 # main
               with:
                   support: ${{ github.event.inputs.support }}
                   token: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file