diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index b39a2ba..eea86ae 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,5 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/analyzeStyle.yml b/.github/workflows/analyzeStyle.yml
index 903377b..1bf1050 100644
--- a/.github/workflows/analyzeStyle.yml
+++ b/.github/workflows/analyzeStyle.yml
@@ -12,9 +12,10 @@ jobs:
       bicep: ${{ steps.changes.outputs.bicep }}
       json: ${{ steps.changes.outputs.json }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
-        fetch-depth: 10
+        fetch-depth: 10
+        persist-credentials: false
     - name: Check for changed files
       id: changes
       run: |
@@ -42,7 +43,9 @@ jobs:
   markdown-link-check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - uses: tcort/github-action-markdown-link-check@e047c5b37f24ab722bbef1a27b6fab7f96bc4068 # v1
       with:
         use-quiet-mode: 'yes'
@@ -52,11 +55,13 @@ jobs:
     if: needs.filter.outputs.bicep == 'true'
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - name: Lint Bicep files
       run: az bicep lint --file azuredeploy.bicep
 
   check-arm-templates:
     needs: filter
     if: needs.filter.outputs.json == 'true'
-    uses: ./.github/workflows/check-arm-template.yml
\ No newline at end of file
+    uses: $/.github/workflows/check-arm-template.yml
diff --git a/.github/workflows/check-arm-template.yml b/.github/workflows/check-arm-template.yml
index 8017555..0959dbc 100644
--- a/.github/workflows/check-arm-template.yml
+++ b/.github/workflows/check-arm-template.yml
@@ -3,21 +3,26 @@ name: Check ARM Template with TTK
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   check-arm-templates:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout the repo
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.ref }}
         path: install
+        persist-credentials: false
 
     - name: Download ARM TTK
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: Azure/arm-ttk
         path: arm-ttk
+        persist-credentials: false
 
     - name: Test ARM Template
       shell: pwsh
diff --git a/.github/workflows/dependabot-auto-merge-actions.yml b/.github/workflows/dependabot-auto-merge-actions.yml
index 5191a72..7e8d9ca 100644
--- a/.github/workflows/dependabot-auto-merge-actions.yml
+++ b/.github/workflows/dependabot-auto-merge-actions.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
diff --git a/.github/workflows/generate-arm-template.yml b/.github/workflows/generate-arm-template.yml
index eb3527f..668298c 100644
--- a/.github/workflows/generate-arm-template.yml
+++ b/.github/workflows/generate-arm-template.yml
@@ -7,15 +7,20 @@ on:
     paths:
       - '**/*.bicep'
 
+permissions:
+  contents: read
+
 jobs:
   build-and-push:
     runs-on: ubuntu-latest
-    permissions:                # Job-level permissions configuration starts here
-      contents: write           # 'write' access to repository contents
+    permissions:
+      contents: write # pushes the generated ARM template back to master
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: true # we persist credentials, so we can push the generated ARM template
 
     - name: Generate ARM template
       run: az bicep build --file azuredeploy.bicep
@@ -30,4 +35,6 @@ jobs:
 
   check-arm-template:
     needs: build-and-push
-    uses: ./.github/workflows/check-arm-template.yml
\ No newline at end of file
+    permissions:
+      contents: read
+    uses: $/.github/workflows/check-arm-template.yml
diff --git a/.github/workflows/prepare-marketplace.yml b/.github/workflows/prepare-marketplace.yml
index f26c314..686c72d 100644
--- a/.github/workflows/prepare-marketplace.yml
+++ b/.github/workflows/prepare-marketplace.yml
@@ -6,14 +6,18 @@ name: Create Artifacts for Marketplace
 on:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   prepare-marketplace:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: 'marketplace'
+          persist-credentials: false
 
       - name: Download Artifacts from install repository
         run: |
@@ -42,8 +46,8 @@ jobs:
           cp CertMaster-Artifacts-Linux.zip publish/dist-certmaster/
 
       - name: Upload Artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: Release
           path: publish/*
-          compression-level: 9
\ No newline at end of file
+          compression-level: 9