diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..16c02f9
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,23 @@
+version: 2
+
+# Third-party actions are pinned to immutable commit SHAs. SHAs never move on
+# their own, so this entry is what keeps them current — without it the pins rot.
+#
+# Only the github-actions ecosystem is enabled. npm version-update PRs are
+# deliberately off: frozen-lockfile installs plus the release cooldown in
+# pnpm-workspace.yaml already manage dependency drift, and a PR per release is
+# noise nobody reads. Dependabot *alerts* are enabled in repo settings and are
+# the signal layer we do want; automated *security-update* PRs are off for the
+# same reason — advisories get triaged against real exposure, not auto-patched.
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    # One PR for all action bumps instead of one per action.
+    groups:
+      actions:
+        patterns:
+          - "*"
+    commit-message:
+      prefix: "ci"
diff --git a/.github/workflows/deploy-docs.yml b/.github/workflows/deploy-docs.yml
index 43ffa71..a7b700c 100644
--- a/.github/workflows/deploy-docs.yml
+++ b/.github/workflows/deploy-docs.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v4
 
       - name: Install Fly CLI
-        uses: superfly/flyctl-actions/setup-flyctl@master
+        uses: superfly/flyctl-actions/setup-flyctl@ed8efb33836e8b2096c7fd3ba1c8afe303ebbff1 # 1.6
 
       - name: Deploy to Fly.io
         run: |
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index a7c44bc..8e4c955 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -14,12 +14,17 @@ jobs:
     timeout-minutes: 15
     steps:
       - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
       - uses: actions/setup-node@v4
         with:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
+      # Informational, not a gate: advisories here are dominated by deep
+      # transitive packages we do not control, and a permanently red step
+      # teaches everyone to ignore it. Read the output.
+      - run: pnpm audit --prod
+        continue-on-error: true
       - run: pnpm typecheck
       - run: pnpm lint
       - run: pnpm spell
diff --git a/package.json b/package.json
index 11d1fe8..cbf5891 100644
--- a/package.json
+++ b/package.json
@@ -9,7 +9,7 @@
     "url": "https://github.com/openprose/docs.git"
   },
   "homepage": "https://docs.prose.md",
-  "packageManager": "pnpm@10.11.0",
+  "packageManager": "pnpm@10.34.5",
   "scripts": {
     "postinstall": "fumadocs-mdx",
     "prebuild": "claude -p 'prose run .prose/generate-agent-skills.prose && prose run .prose/changelog-sync.prose'",
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
new file mode 100644
index 0000000..ce81532
--- /dev/null
+++ b/pnpm-workspace.yaml
@@ -0,0 +1,7 @@
+# Settings only — this repo is a single package, not a pnpm workspace.
+#
+# Freshly published versions are not resolvable for 48h (supply-chain cooldown).
+# Urgent security fix needed sooner? Add the package to minimumReleaseAgeExclude,
+# install, then remove it — a reviewable config change, not a standing hole.
+minimumReleaseAge: 2880
+minimumReleaseAgeExclude: []