diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..583513d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    groups:
+      actions-minor-and-patch:
+        patterns: ["*"]
+        update-types: [minor, patch]
diff --git a/.github/workflows/continuous-deployment.yml b/.github/workflows/continuous-deployment.yml
index 6000c85..874ff39 100644
--- a/.github/workflows/continuous-deployment.yml
+++ b/.github/workflows/continuous-deployment.yml
@@ -9,6 +9,7 @@ permissions:
   pull-requests: write
 jobs:
   release-please:
+    if: github.repository == 'CHIMEFRB/datatrail-cli'
     runs-on: ubuntu-latest
     steps:
       - name: Create release
@@ -23,7 +24,7 @@ jobs:
 
       - name: Install uv
         if: ${{ steps.release-please.outputs.release_created }}
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: false
           python-version: "3.13"
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 737c927..bd0c70f 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -49,7 +49,7 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v10.0.1
+        uses: astral-sh/setup-uv@v10.2.0
         with:
           enable-cache: true
           cache-dependency-glob: "uv.lock"
@@ -100,7 +100,7 @@ jobs:
           fail-on-error: false
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v7.1.1
         with:
           fail_ci_if_error: false
           token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 905da21..03c7b5e 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -1,21 +1,44 @@
 name: Documentation
 on:
   push:
-    branches:
-      - main
+    branches: [main]
     paths:
       - "docs/**"
+      - "mkdocs*.yml"
+      - "pyproject.toml"
+      - "uv.lock"
       - ".github/workflows/docs.yml"
+  pull_request:
+    paths:
+      - "docs/**"
+      - "mkdocs*.yml"
+      - "pyproject.toml"
+      - "uv.lock"
+      - ".github/workflows/docs.yml"
+  workflow_dispatch:
 
 permissions:
   contents: read
 
 jobs:
-  mkdocs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10.2.0
+        with:
+          python-version: "3.13"
+          enable-cache: true
+      - run: uv sync --locked --group docs
+      - run: uv run --no-sync mkdocs build --strict --config-file mkdocs-site.yml
+
+  handbook:
+    if: github.repository == 'CHIMEFRB/datatrail-cli' && github.event_name == 'push'
+    needs: build
     runs-on: ubuntu-latest
     steps:
-      - name: Build chimefrb/handbook
-        uses: peter-evans/repository-dispatch@v3
+      - name: Build the upstream handbook
+        uses: peter-evans/repository-dispatch@v4.0.1
         with:
           token: ${{ secrets.BUILD_HANDBOOK_TOKEN }}
           repository: chimefrb/handbook
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 99da488..d0f1d55 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -11,10 +11,11 @@ permissions:
 
 jobs:
   close_stale_prs:
+    if: github.repository == 'CHIMEFRB/datatrail-cli'
     runs-on: ubuntu-latest
     steps:
       - name: Close stale pull requests
-        uses: actions/stale@v9
+        uses: actions/stale@v11.0.0
         with:
           days-before-stale: 90
           days-before-close: 7