diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..6cc00712d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/close-pulls.yml b/.github/workflows/close-pulls.yml
index 8a95bccc0..53cac6751 100644
--- a/.github/workflows/close-pulls.yml
+++ b/.github/workflows/close-pulls.yml
@@ -11,7 +11,7 @@
       
       steps:
         - name: Close Pull Requests
-          uses: peter-evans/close-fork-pulls@v2
+          uses: peter-evans/close-fork-pulls@759a18619e1876d53588173e9321d49a00188360 # v2.0.1
           with:
             comment: |
               As of 2023-11-30 we have stopped the 2-way sync between this repository and our internal repository, so that our internal repository becomes the source of truth for the backup-utils source code. With the the 2-way sync stopped, this public repository will be used to host documentation about backup-utils and to publish new versions of backup-utils. You will be able to access a specific version of backup-utils (which includes the full source code) from the [release page](https://github.com/github/backup-utils/releases) of this repository.