diff --git a/.github/actions/build-nix/action.yml b/.github/actions/build-nix/action.yml
index d20f297..e3b3c35 100644
--- a/.github/actions/build-nix/action.yml
+++ b/.github/actions/build-nix/action.yml
@@ -14,7 +14,8 @@ runs:
     shell: bash
   - run: nix run -L --inputs-from . 'nixpkgs#coreutils' -- --coreutils-prog=ginstall -p "./result${{ inputs.install-path }}" '${{ inputs.package }}'
     shell: bash
-  - uses: actions/upload-artifact@v3
+  - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
     with:
       name: ${{ inputs.package }}
       path: ${{ inputs.package }}
+      if-no-files-found: error
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7aeb0f3..6178b9c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,3 +8,11 @@ updates:
   directory: "/"
   schedule:
     interval: "daily"
+- package-ecosystem: "github-actions"
+  directory: "/.github/actions/build-nix"
+  schedule:
+    interval: "daily"
+- package-ecosystem: "github-actions"
+  directory: "/.github/actions/install-nix"
+  schedule:
+    interval: "daily"
diff --git a/.github/workflows/wit-deps.yml b/.github/workflows/wit-deps.yml
index 2849581..790fa27 100644
--- a/.github/workflows/wit-deps.yml
+++ b/.github/workflows/wit-deps.yml
@@ -71,10 +71,10 @@ jobs:
     needs: build-bin
     runs-on: macos-12
     steps:
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-aarch64-apple-darwin
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-x86_64-apple-darwin
     - run: chmod +x ./wit-deps-x86_64-apple-darwin
@@ -82,10 +82,11 @@ jobs:
     - run: lipo -create ./wit-deps-aarch64-apple-darwin ./wit-deps-x86_64-apple-darwin -output ./wit-deps-universal-darwin
     - run: chmod +x ./wit-deps-universal-darwin
     - run: ./wit-deps-universal-darwin --version
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
       with:
         name: wit-deps-universal-darwin
         path: wit-deps-universal-darwin
+        if-no-files-found: error
 
   cargo:
     strategy:
@@ -174,46 +175,46 @@ jobs:
       contents: write
     steps:
     - uses: actions/checkout@v4
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-aarch64-apple-darwin
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-aarch64-unknown-linux-musl
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-armv7-unknown-linux-musleabihf
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-universal-darwin
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-x86_64-apple-darwin
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-x86_64-pc-windows-gnu
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-x86_64-unknown-linux-musl
 
     - run: chmod +x ./wit-deps-*
 
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-aarch64-apple-darwin-oci
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-aarch64-unknown-linux-musl-oci
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-armv7-unknown-linux-musleabihf-oci
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-x86_64-pc-windows-gnu-oci
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-x86_64-apple-darwin-oci
-    - uses: actions/download-artifact@v3
+    - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
       with:
         name: wit-deps-x86_64-unknown-linux-musl-oci