diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..a9c1b32
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      external-github-actions:
+          patterns:
+              - '*/*'
+          exclude-patterns:
+              - Tricentis*/*
diff --git a/.github/workflows/close-pull-requests.yml b/.github/workflows/close-pull-requests.yml
index 831efae..5444332 100644
--- a/.github/workflows/close-pull-requests.yml
+++ b/.github/workflows/close-pull-requests.yml
@@ -14,13 +14,13 @@ permissions:
 
 jobs:
   close:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-stepsecurity-x64
     if: >-
       github.event.pull_request.author_association != 'OWNER' &&
       github.event.pull_request.author_association != 'MEMBER' &&
       github.event.pull_request.author_association != 'COLLABORATOR'
     steps:
-      - uses: actions/github-script@v7
+      - uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const { owner, repo } = context.repo;