diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..90e05c40d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "weekly"
diff --git a/.github/workflows/build-all.yml b/.github/workflows/build-all.yml
index 158eadf3c..5142a0ef4 100644
--- a/.github/workflows/build-all.yml
+++ b/.github/workflows/build-all.yml
@@ -49,7 +49,7 @@ jobs:
 
   check-size:
     name: Check size
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
     - build
 
diff --git a/.github/workflows/build-firmware.yml b/.github/workflows/build-firmware.yml
index 8aa6a9c9f..8ffb1ace4 100644
--- a/.github/workflows/build-firmware.yml
+++ b/.github/workflows/build-firmware.yml
@@ -21,9 +21,9 @@ jobs:
 
     name: Build a firmware ${{ inputs.keyboard }}:${{ inputs.keymap }}
 
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     container:
-      image: ghcr.io/qmk/qmk_cli:latest
+      image: ghcr.io/qmk/qmk_cli@sha256:16c4916e95b99bf88d27b15aec8db409ee17265d1710287fde248c6666508966
 
     steps:
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0154933ed..c7ba59ba2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ jobs:
 
   deploy:
     name: Deploy firmwares
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-22.04
     needs:
     - build