diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..2390d8c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 40080df..1b8b13a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "master" ]
 
+permissions:
+  contents: read
+
 jobs:
   test-nginx:
     strategy:
@@ -15,7 +18,7 @@ jobs:
     runs-on: "ubuntu-20.04"
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: get dependencies
       run: |
          sudo apt update
@@ -25,7 +28,7 @@ jobs:
          sudo apt-get install libnet-dns-perl
          sudo cpan -T -i Test::More
     - name: 'checkout luajit2'
-      uses: actions/checkout@v3
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: openresty/luajit2
         path: luajit2
diff --git a/.github/workflows/test_nginx_lastest_commit.yml b/.github/workflows/test_nginx_lastest_commit.yml
index 04835cb..72abd06 100644
--- a/.github/workflows/test_nginx_lastest_commit.yml
+++ b/.github/workflows/test_nginx_lastest_commit.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "master" ]
 
+permissions:
+  contents: read
+
 jobs:
   test-nginx:
     strategy:
@@ -18,7 +21,7 @@ jobs:
        CC: ${{ matrix.compiler.CC }}
        CXX: ${{ matrix.compiler.CXX }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: get dependencies
       run: |
          sudo apt update
@@ -28,7 +31,7 @@ jobs:
          sudo apt-get install libnet-dns-perl
          sudo cpan -T -i Test::More
     - name: 'checkout luajit2'
-      uses: actions/checkout@v3
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       with:
         repository: openresty/luajit2
         path: luajit2
diff --git a/.github/workflows/test_openresty.yml b/.github/workflows/test_openresty.yml
index ab04d0a..d21b0d9 100644
--- a/.github/workflows/test_openresty.yml
+++ b/.github/workflows/test_openresty.yml
@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: [ "master" ]
 
+permissions:
+  contents: read
+
 jobs:
   test-openresty:
     strategy:
@@ -15,7 +18,7 @@ jobs:
     runs-on: "ubuntu-20.04"
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
     - name: get dependencies
       run: |
          sudo apt update