diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..5ace4600
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 00000000..a0408cfd
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,35 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/build.yml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'microsoft/setup-msbuild@v3.0.0'
+        - 'msys2/setup-msys2@v2.33.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v6.1.0'
+    '.github/workflows/verify-lockfile.yml':
+        - 'actions/checkout@v6.1.0'
+dependencies:
+    'actions/checkout@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'microsoft/setup-msbuild@v3.0.0':
+        ref: 'v3.0.0'
+        commit: 'sha1-30375c66a4eea26614e0d39710365f22f8b0af57'
+        owner_id: 6154722
+        repo_id: 237360465
+    'msys2/setup-msys2@v2.33.0':
+        ref: 'v2.33.0'
+        commit: 'sha1-ec48f7c5447b3140e2b088413ae3a55687bccb6e'
+        owner_id: 6759993
+        repo_id: 213203501
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ed79bb5b..e5368148 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -2,6 +2,9 @@ name: Build
 
 on: [push, pull_request]
 
+permissions:
+  contents: read
+
 jobs:
 
   linux:
@@ -19,7 +22,9 @@ jobs:
       CC: ${{ matrix.compiler }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
       - name: Install dependencies
         run: |
           sudo apt-get update
@@ -32,7 +37,7 @@ jobs:
         run: |
           make install DESTDIR=$PWD/artifacts
           tar -czf ${{ github.job }}-${{ matrix.compiler }}.tar.gz -C artifacts usr/local
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           path: ${{ github.job }}-${{ matrix.compiler }}.tar.gz
           archive: false
@@ -52,7 +57,9 @@ jobs:
       CC: ${{ matrix.compiler }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
       - name: Install dependencies
         run: brew install autoconf automake libtool hidapi libusb
       - run: autoreconf --install --force
@@ -63,7 +70,7 @@ jobs:
         run: |
           make install DESTDIR=$PWD/artifacts
           tar -czf ${{ github.job }}-${{ matrix.compiler }}.tar.gz -C artifacts usr/local
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           path: ${{ github.job }}-${{ matrix.compiler }}.tar.gz
           archive: false
@@ -80,7 +87,9 @@ jobs:
         arch: [i686, x86_64]
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
       - name: Install dependencies
         run: |
           sudo apt-get update
@@ -122,7 +131,7 @@ jobs:
         run: |
           make install DESTDIR=$PWD/artifacts
           tar -czf ${{ github.job }}-${{ matrix.arch }}.tar.gz -C artifacts usr/local
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           path: ${{ github.job }}-${{ matrix.arch }}.tar.gz
           archive: false
@@ -142,8 +151,10 @@ jobs:
       CONFIGURATION: Release
 
     steps:
-      - uses: actions/checkout@v6
-      - uses: msys2/setup-msys2@v2
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
+      - uses: msys2/setup-msys2@v2.33.0
         with:
           install: autoconf automake libtool pkg-config make gcc
       - run: |
@@ -151,9 +162,9 @@ jobs:
           ./configure
           make -C src revision.h
         shell: msys2 {0}
-      - uses: microsoft/setup-msbuild@v3
+      - uses: microsoft/setup-msbuild@v3.0.0
       - run: msbuild -m -p:Platform=${{ matrix.platform }} -p:Configuration=${{ env.CONFIGURATION }} contrib/msvc/libdivecomputer.vcxproj
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: ${{ github.job }}-${{ matrix.platform }}.zip
           path: contrib/msvc/${{ matrix.platform }}/${{ env.CONFIGURATION }}/bin
@@ -165,13 +176,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
       - run: |
           autoreconf --install --force
           ./configure
           make -C src revision.h
       - run: $ANDROID_NDK/ndk-build -C contrib/android NDK_PROJECT_PATH=. APP_BUILD_SCRIPT=Android.mk
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: ${{ github.job }}.zip
           path: contrib/android/libs
@@ -190,7 +203,9 @@ jobs:
       UBSAN_OPTIONS: halt_on_error=1:print_stacktrace=1
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
       - name: Install dependencies
         run: |
           sudo apt-get update
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f9b2d789..e62f4f96 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,12 +4,17 @@ on:
   push:
     tags: 'v*'
 
+permissions:
+  contents: write
+
 jobs:
   release:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
 
       - name: Version number
         id: version
diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml
new file mode 100644
index 00000000..06f645c5
--- /dev/null
+++ b/.github/workflows/verify-lockfile.yml
@@ -0,0 +1,26 @@
+name: Verify workflow lockfile
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
+
+      - name: Install lockfile verifier
+        run: gh extension install github/gh-actions-lock --pin v0.4.0
+        env:
+          GH_TOKEN: ${{ github.token }}
+
+      - name: Verify lockfile
+        run: gh actions-lock --verify
+        env:
+          GH_TOKEN: ${{ github.token }}