diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 6e4ab2f..fd38f35 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -8,7 +8,7 @@ updates:
   - package-ecosystem: "nuget"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
     groups:
       minor-version-updates:
         applies-to: version-updates
@@ -18,4 +18,4 @@ updates:
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
-      interval: "daily"
+      interval: "weekly"
diff --git a/.github/release.yml b/.github/release.yml
new file mode 100644
index 0000000..1d8bb9d
--- /dev/null
+++ b/.github/release.yml
@@ -0,0 +1,11 @@
+changelog:
+  categories:
+    - title: 🏕 Features
+      labels:
+        - "*"
+      exclude:
+        labels:
+          - dependencies
+    - title: 👒 Dependencies
+      labels:
+        - dependencies
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index 898a133..1221145 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7 #v2.3.0
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Approve
diff --git a/.github/workflows/msbuild.yml b/.github/workflows/msbuild.yml
index ce0d0b4..50581f3 100644
--- a/.github/workflows/msbuild.yml
+++ b/.github/workflows/msbuild.yml
@@ -11,6 +11,9 @@ on:
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   build:
     strategy:
diff --git a/.github/workflows/nuget.yml b/.github/workflows/nuget.yml
index 53b3fa2..23af995 100644
--- a/.github/workflows/nuget.yml
+++ b/.github/workflows/nuget.yml
@@ -4,20 +4,23 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+
 jobs:
   release:
 
-    runs-on: windows-2022
+    runs-on: windows-latest
 
     steps:
 
     - uses: actions/checkout@v4
       with:
-        fetch-depth: 0    
+        fetch-depth: 0
 
-    - uses: microsoft/setup-msbuild@v2
+    - uses: microsoft/setup-msbuild@6fb02220983dee41ce7ae257b6f4d8f9bf5ed4ce #v2
 
-    - uses: NuGet/setup-nuget@v2
+    - uses: NuGet/setup-nuget@323ab0502cd38fdc493335025a96c8fdb0edc71f #v2.0.1
 
     - name: Restore NuGet packages
       run: nuget restore
@@ -31,4 +34,3 @@ jobs:
            nuget push $package $env:nuget_api_key -src https://nuget.org
       env:
         nuget_api_key: ${{ secrets.NUGET_API_KEY }}
-