diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c75871e..2f8262c 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,3 +9,7 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    groups:
+      action-deps:
+        patterns:
+          - "*"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 25a9b45..ee41657 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -13,6 +13,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: docker/setup-buildx-action@v3
 
       - uses: docker/login-action@v3
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 77187ae..1657abc 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,6 +15,8 @@ jobs:
 
     steps:
       - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
       - uses: docker/setup-buildx-action@v3
 
       - uses: docker/login-action@v3