diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bccacde..fd666cc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,3 +5,5 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 5
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 51eeea1..5191c19 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,7 +9,7 @@ on:
 env:
   GOTOOLCHAIN: local
 
-permissions: # added using https://github.com/step-security/secure-workflows
+permissions:
   contents: read
 
 jobs:
@@ -30,17 +30,16 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
 
     steps:
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v6
-      - uses: golangci/golangci-lint-action@v9
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.12
+          version: v2.13
           skip-cache: true
-          args: --timeout=5m
 
   #
   # Project checks
@@ -52,17 +51,17 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
           cache: false # see actions/setup-go#368
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: src/github.com/containerd/log
           fetch-depth: 25
 
-      - uses: containerd/project-checks@v1.2.2
+      - uses: containerd/project-checks@d7751f3c375b8fe4a84c02a068184ee4c1f59bc4 # v1.2.2
         with:
           working-directory: src/github.com/containerd/log
           repo-access-token: ${{ secrets.GITHUB_TOKEN }}
@@ -80,14 +79,15 @@ jobs:
           - stable
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: src/github.com/containerd/log
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: ${{ matrix.go-version }}
           go-version-file: src/github.com/containerd/log/go.mod # used when go-version is empty
+          cache: false # see actions/setup-go#368
 
       - name: Set env
         shell: bash
diff --git a/.golangci.yml b/.golangci.yml
index c747d1f..5c3bdd7 100644
--- a/.golangci.yml
+++ b/.golangci.yml
@@ -45,3 +45,6 @@ formatters:
       - releases
       - reports
       - test
+
+run:
+  timeout: 5m