diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 961b3cf..d39499a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,21 +1,61 @@
 version: 2
+
 updates:
+  # GitHub Actions — only minor and patch updates (no major bumps).
   - package-ecosystem: github-actions
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 2
+    groups:
+      actions:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
     labels:
       - dependencies
       - github-actions
+
+  # npm dependencies — only minor and patch updates.
   - package-ecosystem: npm
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 2
+    groups:
+      production:
+        dependency-type: production
+        update-types:
+          - minor
+          - patch
+      development:
+        dependency-type: development
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 10
     labels:
       - dependencies
+
+  # pip dependencies — only minor and patch updates.
   - package-ecosystem: pip
     directory: /
     schedule:
       interval: monthly
+    cooldown:
+      default-days: 2
+    groups:
+      python-deps:
+        patterns:
+          - "*"
+        update-types:
+          - minor
+          - patch
+    open-pull-requests-limit: 5
     labels:
       - dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 626706c..164afdc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
 
@@ -25,7 +25,7 @@ jobs:
         with:
           python-version: "3.12"
 
-      - uses: actions/setup-node@v7.0.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: "22"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index a4367c9..5dee4f0 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -16,11 +16,11 @@ jobs:
       matrix:
         python-version: ["3.8", "3.12"]
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v4.4.0
       - uses: actions/setup-python@v5.6.0
         with:
           python-version: ${{ matrix.python-version }}
-      - uses: actions/setup-node@v7.0.0
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: "22"
       - run: python3 -m pip install pyyaml==6.0.3
@@ -31,7 +31,7 @@ jobs:
   secrets:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
       - run: bash scripts/scan-secrets.sh