diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..aa7f3a5
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+# 依赖更新通道（审计 2026-09-22 M-3/L 级）：
+# - github-actions：actions 已按 commit SHA 钉固，升级经 dependabot PR 显式过目
+# - npm：周度汇总补丁升级 PR（lockfile 约束 --frozen-lockfile，PR 会同时刷新 lock）
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    # 演示模板：只自动提补丁与小版本，大版本升级（umi/antd/react 等）人工评估
+    open-pull-requests-limit: 5
+    groups:
+      patch-and-minor:
+        update-types:
+          - patch
+          - minor
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9bcfdfc..d76c481 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -11,19 +11,23 @@ concurrency:
   group: ci-${{ github.head_ref || github.ref_name }}
   cancel-in-progress: true
 
-# 注：actions 使用次版本钉住的标签；后续可升级为 commit SHA 钉固（供应链加固 TODO）
+# 最小权限（审计 2026-09-22 M-4）：PR 检查只需读取仓库内容，不依赖仓库默认的宽松 token 权限
+permissions:
+  contents: read
+
+# 注：actions 按 commit SHA 钉固（注释保留版本号）；升级由 dependabot 提 PR（.github/dependabot.yml）
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm（读 packageManager 字段）
-        uses: pnpm/action-setup@v6.1.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -48,13 +52,13 @@ jobs:
         script: [build, 'build:github']
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm（读 packageManager 字段）
-        uses: pnpm/action-setup@v6.1.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b178309..08d8b1c 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -9,19 +9,24 @@ concurrency:
   group: gh-pages-deploy
   cancel-in-progress: true
 
+# 最小权限（审计 2026-09-22 M-4）：部署需要写 gh-pages 分支；peaceiris action 持有的
+# GITHUB_TOKEN 即受此约束，tag 劫持时的爆炸半径被限定在部署分支
+permissions:
+  contents: write
+
 jobs:
   build-and-deploy:
     runs-on: ubuntu-latest
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup pnpm（读 packageManager 字段）
-        uses: pnpm/action-setup@v6.1.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7.0.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: pnpm
@@ -50,7 +55,7 @@ jobs:
         run: cp dist/index.html dist/404.html
 
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4.1.0
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./dist
diff --git a/Dockerfile b/Dockerfile
index c809ec7..40f6a4e 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1
 
 # ---------- 阶段一：构建 ----------
-FROM node:22-alpine AS builder
+FROM node:22-alpine@sha256:b6f26b36c8ff49624cfdac716b8ea1138d606df02586a77d364bb5536a634f85 AS builder
 WORKDIR /app
 
 # 先装依赖以利用层缓存
@@ -10,8 +10,9 @@ RUN corepack enable && pnpm install --frozen-lockfile
 
 # 源码与构建（Cesium token 经 build-arg 注入，最终 define 进产物）
 COPY . .
+# token 经 ARG 注入（RUN 中直接可见）。不落 ENV：ENV 会把值持久化进 builder 镜像层，
+# docker history 可见（审计 2026-09-22 L-1；最终运行镜像虽不继承，但没有理由留下这层痕迹）
 ARG CESIUM_ION_TOKEN=""
-ENV CESIUM_ION_TOKEN=$CESIUM_ION_TOKEN
 RUN pnpm build
 
 # ---------- 阶段二：运行（全程非 root） ----------