diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index ef839c4..7518288 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,13 +8,21 @@ updates:
       prefix: 'chore'
       include: 'scope'
     cooldown:
-      default-days: 5
+      default-days: 2
+    groups:
+      github-actions-minor-patch:
+        patterns: ['*']
+        update-types: ['minor', 'patch']
   - package-ecosystem: 'npm'
     directory: '/'
     schedule:
-      interval: 'weekly'
+      interval: 'monthly'
     commit-message:
       prefix: 'chore'
       include: 'scope'
     cooldown:
       default-days: 5
+    groups:
+      npm-minor-patch:
+        patterns: ['*']
+        update-types: ['minor', 'patch']
diff --git a/.github/workflows/depsound-post.yml b/.github/workflows/depsound-post.yml
new file mode 100644
index 0000000..f595120
--- /dev/null
+++ b/.github/workflows/depsound-post.yml
@@ -0,0 +1,19 @@
+# Posts the report artifact without checking out or running PR code with its
+# write token.
+name: depsound-post
+on:
+  workflow_run:
+    workflows: [depsound]
+    types: [completed]
+
+permissions:
+  pull-requests: write # upsert the sticky comment
+  checks: write        # set the neutral check
+  actions: read        # download the report artifact from the compute run
+
+jobs:
+  post:
+    runs-on: ubuntu-latest
+    if: ${{ github.event.workflow_run.event == 'pull_request' }}
+    steps:
+      - uses: rvagg/depsound-action/post@2c5a7429aa5baaf8a79e12724a296282cd73e5ee # v0.2.1
diff --git a/.github/workflows/depsound.yml b/.github/workflows/depsound.yml
new file mode 100644
index 0000000..30a0e63
--- /dev/null
+++ b/.github/workflows/depsound.yml
@@ -0,0 +1,14 @@
+# Computes dependency evidence with a read-only token; depsound-post handles
+# the write side without exposing it to PR code.
+name: depsound
+on:
+  pull_request:
+
+permissions:
+  contents: read # checkout + diff the PR's manifests; no write, never posts
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: rvagg/depsound-action@2c5a7429aa5baaf8a79e12724a296282cd73e5ee # v0.2.1
diff --git a/.github/workflows/test-and-release.yml b/.github/workflows/test-and-release.yml
index d27ee76..e186ce6 100644
--- a/.github/workflows/test-and-release.yml
+++ b/.github/workflows/test-and-release.yml
@@ -11,9 +11,9 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Use Node.js ${{ matrix.node }}
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node }}
       - name: Install Dependencies
@@ -37,11 +37,11 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7.0.0
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
       - name: Setup Node.js
-        uses: actions/setup-node@v6.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: lts/*
           registry-url: 'https://registry.npmjs.org'