diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..3c6d7ab
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,26 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      actions:
+        patterns:
+          - "*"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: "gomod"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    groups:
+      all-minor-patch:
+        update-types:
+          - "minor"
+          - "patch"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c95f3f9..41d661b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,55 +15,56 @@ on:
       - "main"
 
 jobs:
-  build:
-    name: Build and Test
+  validate-workflows:
+    name: Validate GitHub Workflows
     runs-on: ubuntu-latest
 
     permissions:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Set up Go
-        uses: actions/setup-go@v5
+      - name: Set up Python
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          go-version: 1.24
-          cache: false  # avoid cache-poisoning attacks
-
-      - name: Build
-        run: go build -v ./...
+          python-version: '3.13'
 
-      - name: Test
-        run: go test -v ./...
+      - name: Check Workflows
+        run: |
+          python -m pip install zizmor --root-user-action=ignore
+          zizmor .github/workflows/*
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-  validate-workfows:
-    name: Validate GitHub Workflows
+  build:
+    name: Build and Test
     runs-on: ubuntu-latest
+    needs: validate-workflows
 
     permissions:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          python-version: '3.13'
+          go-version-file: go.mod
+          cache: false  # avoid cache-poisoning attacks
 
-      - name: Check Workflows
-        run: |
-          python -m pip install zizmor --root-user-action=ignore
-          zizmor .github/workflows/*
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Build
+        run: go build -v ./...
+
+      - name: Test
+        run: go test -v ./...
 
   release:
     name: Create and Publish Release
@@ -77,15 +78,15 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.24
+          go-version-file: go.mod
           cache: false  # avoid cache-poisoning attacks
 
       - name: Install go tools
diff --git a/go.mod b/go.mod
index 3280861..056c449 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/cloudscale-ch/fleeting-plugin-cloudscale
 
-go 1.24
+go 1.27.3
 
 require (
 	github.com/cloudscale-ch/cloudscale-go-sdk/v6 v6.0.0
diff --git a/tool.mod b/tool.mod
index bbbb24f..12b922e 100644
--- a/tool.mod
+++ b/tool.mod
@@ -1,6 +1,6 @@
 module github.com/cloudscale-ch/fleeting-plugin-cloudscale
 
-go 1.24
+go 1.27.3
 
 tool (
 	github.com/goreleaser/goreleaser/v2