diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 91e92d65..d576a048 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 1
     groups:
       gradle-patch-minor:
         update-types: ["patch", "minor"]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc638ba5..612d3a40 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,13 +63,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 
@@ -94,13 +94,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 
@@ -132,13 +132,13 @@ jobs:
           printf '%s\n' "$app_parents" | tee -a "$GITHUB_STEP_SUMMARY"
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 
diff --git a/.github/workflows/emulator-smoke.yml b/.github/workflows/emulator-smoke.yml
index 05d61236..cbf868a8 100644
--- a/.github/workflows/emulator-smoke.yml
+++ b/.github/workflows/emulator-smoke.yml
@@ -59,13 +59,13 @@ jobs:
           printf '%s\n' "$app_parents" | tee -a "$GITHUB_STEP_SUMMARY"
 
       - name: Set up Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
         with:
           distribution: temurin
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
         with:
           validate-wrappers: true
 
diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
new file mode 100644
index 00000000..486e0b22
--- /dev/null
+++ b/.github/workflows/scan.yml
@@ -0,0 +1,19 @@
+name: Scan
+
+on:
+  pull_request:
+  schedule:
+    - cron: "41 6 * * 1"
+  workflow_dispatch:
+
+permissions: {}
+
+concurrency:
+  group: scan-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  scan:
+    permissions:
+      contents: read
+    uses: putdotio/.github/.github/workflows/frontend-scan.yml@1ee0d3b473cbc6fada08831f01ff80fe653c434a # v1.1.0
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 00000000..54af4065
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,8 @@
+rules:
+  dependabot-cooldown:
+    config:
+      days: 1
+  unpinned-uses:
+    config:
+      policies:
+        "*": hash-pin
diff --git a/AGENTS.md b/AGENTS.md
index ea6b2a5f..0cbb14df 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -160,6 +160,10 @@ and `StaleOAuthCallbackTest` on a Gradle Managed Device weekly and on dispatch.
 It is not a pull-request gate because shared-runner emulator boots are too slow
 and flaky; `scripts/prove.sh` stays the local proof.
 
+[Scan](.github/workflows/scan.yml) runs the shared put.io scan weekly and on
+every pull request: Gitleaks and TruffleHog look for secrets, and Actionlint
+and Zizmor audit `.github/` when a pull request changes it.
+
 To reproduce a CI failure, check out the app SHA from the run summary in a
 detached worktree with `sdk.dir` set and `putioSdkKotlinPath` unset, then run
 the same command. A pull-request run tests a temporary merge commit; if it is