diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 87294ce..36c35c9 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,6 +4,8 @@ updates:
     directory: "/"
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
   - package-ecosystem: npm
     directory: "/"
     groups:
@@ -13,3 +15,5 @@ updates:
         dependency-type: production
     schedule:
       interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index cdddecb..7f4cd3d 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -29,6 +29,7 @@ jobs:
           # a pull request then we can checkout the head of the pull request.
           # Only include this option if you are running this workflow on pull requests.
           fetch-depth: 2
+          persist-credentials: false
 
       # If this run was triggered by a pull request event then checkout
       # the head of the pull request instead of the merge commit.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 68d5045..3e7217c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,6 +20,8 @@ jobs:
         with:
           node-version: 24.x
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - run: |
           npm install
           npm run all
@@ -48,6 +50,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -81,6 +85,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -111,6 +117,8 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -143,6 +151,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x
@@ -170,6 +180,8 @@ jobs:
       pull-requests: read
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: actions/setup-node@v6
         with:
           node-version: 24.x