diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 592662bb..3366ecc6 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -3,10 +3,13 @@ updates:
   # GitHub Actions
   - package-ecosystem: "github-actions"
     directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
     schedule:
       interval: "weekly"
-      day: "wednesday"
-    open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
   # NuGet packages
   - package-ecosystem: "nuget"
     directory: "/"
diff --git a/.github/workflows/build-docs-verifier.yml b/.github/workflows/build-docs-verifier.yml
index be32f1f7..9675e591 100644
--- a/.github/workflows/build-docs-verifier.yml
+++ b/.github/workflows/build-docs-verifier.yml
@@ -10,15 +10,15 @@ jobs:
         configuration: [debug, release]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@main
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
       - name: Setup .NET
-        uses: actions/setup-dotnet@main
+        uses: actions/setup-dotnet@v6
         with:
           dotnet-version: '10.0.x'
       - name: Try get cached dependencies
-        uses: actions/cache@main
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
         with:
           path: ${{ github.workspace }}/.nuget/packages
           key: ${{ runner.os }}-nuget-${{ hashFiles('**/packages.lock.json') }}
@@ -31,7 +31,7 @@ jobs:
       - name: Test
         run: dotnet test actions/docs-verifier
       - name: Upload Results
-        uses: actions/upload-artifact@main
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: ${{ matrix.os }}_${{ matrix.configuration }}
           path: |
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 8d42cbba..f1c559e3 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -26,20 +26,20 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@main
+      uses: actions/checkout@v7
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@main
+      uses: github/codeql-action/init@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
       with:
         languages: ${{ matrix.language }}
 
     - name: Build JavaScript
       if: ${{ matrix.language == 'javascript' }}
-      uses: github/codeql-action/autobuild@main
+      uses: github/codeql-action/autobuild@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
 
     - name: Setup .NET
       if: ${{ matrix.language == 'csharp' }}
-      uses: actions/setup-dotnet@main
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: 10.0.x
 
@@ -53,4 +53,4 @@ jobs:
         dotnet build --configuration Release --no-restore
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@main
+      uses: github/codeql-action/analyze@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
diff --git a/.github/workflows/dotnet-build-validation.yml b/.github/workflows/dotnet-build-validation.yml
index af0088a1..08f32eac 100644
--- a/.github/workflows/dotnet-build-validation.yml
+++ b/.github/workflows/dotnet-build-validation.yml
@@ -23,7 +23,7 @@ jobs:
     name: build
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@main
+    - uses: actions/checkout@v7
 
     - name: 'Print manual run reason'
       if: ${{ github.event_name == 'workflow_dispatch' }}
@@ -33,14 +33,14 @@ jobs:
         REASON: ${{ github.event.inputs.reason }}
 
     - name: Setup .NET 10.0
-      uses: actions/setup-dotnet@main
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: 10.0.x
 
     - name: Restore dependencies for .NET docs tools
       run: |
         dotnet restore docs-tools.sln
-      
+
     - name: Build .NET docs tools
       run: |
         dotnet build docs-tools.sln --configuration Release --no-restore
@@ -51,10 +51,10 @@ jobs:
     needs: build
 
     steps:
-    - uses: actions/checkout@main
-    
+    - uses: actions/checkout@v7
+
     - name: Setup .NET 10.0
-      uses: actions/setup-dotnet@main
+      uses: actions/setup-dotnet@v6
       with:
         dotnet-version: 10.0.x
 
diff --git a/.github/workflows/node-build-validation.yml b/.github/workflows/node-build-validation.yml
index 97943130..c21b173b 100644
--- a/.github/workflows/node-build-validation.yml
+++ b/.github/workflows/node-build-validation.yml
@@ -17,9 +17,9 @@ jobs:
     name: build
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@main
+    - uses: actions/checkout@v7
     - name: Use Node.js 18
-      uses: actions/setup-node@main
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: 18
         cache: 'npm'
diff --git a/.github/workflows/quest-bulk.yml b/.github/workflows/quest-bulk.yml
index dd2f52ff..24e2f193 100644
--- a/.github/workflows/quest-bulk.yml
+++ b/.github/workflows/quest-bulk.yml
@@ -23,7 +23,7 @@ jobs:
       id-token: write
       pull-requests: write
     if: ${{ github.repository_owner == 'dotnet' }}
-    
+
     steps:
       - name: "Print manual bulk import run reason"
         if: ${{ github.event_name == 'workflow_dispatch' }}
@@ -34,7 +34,7 @@ jobs:
 
       - name: Azure OpenID Connect
         id: azure-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: $/.github/actions/oidc-auth-flow
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -42,7 +42,7 @@ jobs:
 
       - name: Azure DevOps OpenID Connect
         id: azure-devops-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: $/.github/actions/oidc-auth-flow
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -50,7 +50,7 @@ jobs:
 
       - name: bulk-sequester
         id: bulk-sequester
-        uses: dotnet/docs-tools/actions/sequester@main
+        uses: $/.github/actions/sequester
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }}
diff --git a/.github/workflows/quest.yml b/.github/workflows/quest.yml
index 5e758c34..e4fd4a8f 100644
--- a/.github/workflows/quest.yml
+++ b/.github/workflows/quest.yml
@@ -40,7 +40,7 @@ jobs:
 
       - name: Azure OpenID Connect
         id: azure-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: $/.github/actions/oidc-auth-flow
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -48,7 +48,7 @@ jobs:
 
       - name: Azure DevOps OpenID Connect for manual test runs
         id: azure-devops-oidc-auth
-        uses: dotnet/docs-tools/.github/actions/oidc-auth-flow@main
+        uses: $/.github/actions/oidc-auth-flow
         with:
           client-id: ${{ secrets.CLIENT_ID }}
           tenant-id: ${{ secrets.TENANT_ID }}
@@ -59,7 +59,7 @@ jobs:
       - name: manual-sequester
         if: ${{ github.event_name == 'workflow_dispatch' }}
         id: manual-sequester
-        uses: dotnet/docs-tools/actions/sequester@main
+        uses: $/.github/actions/sequester
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__AzureAccessToken:  ${{ steps.azure-oidc-auth.outputs.access-token }}
@@ -75,7 +75,7 @@ jobs:
       - name: auto-sequester
         if: ${{ github.event_name != 'workflow_dispatch' }}
         id: auto-sequester
-        uses: ./actions/sequester
+        uses: $/.github/actions/sequester
         env:
           ImportOptions__ApiKeys__GitHubToken: ${{ secrets.GITHUB_TOKEN }}
           ImportOptions__ApiKeys__AzureAccessToken: ${{ steps.azure-oidc-auth.outputs.access-token }}