diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 20d5f35..008272a 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,10 +1,18 @@
 version: 2
 updates:
-  - package-ecosystem: gomod
+  - package-ecosystem: "gomod"
+    commit-message:
+      prefix: "deps:"
     directory: "/"
     schedule:
-      interval: daily
-  - package-ecosystem: github-actions
+      interval: "weekly"
+      day: "sunday"
+      time: "09:00"
+  - package-ecosystem: "github-actions"
+    commit-message:
+      prefix: "ci:"
     directory: "/"
     schedule:
-      interval: daily
+      interval: "weekly"
+      day: "sunday"
+      time: "09:00"
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 93c6c18..c800836 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -4,20 +4,14 @@ on:
   push:
     branches: [main]
   pull_request:
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to create'
-        required: true
-        default: 'v0.0.0'
+    branches: [main]
+  schedule:
+    - cron: '0 0 * * 0' # run "At 00:00 on Sunday"
 
 # See https://github.com/cristalhq/.github/.github/workflows
 jobs:
   build:
-    uses: cristalhq/.github/.github/workflows/build.yml@main
+    uses: cristalhq/.github/.github/workflows/build.yml@v0.6.0
 
-  release:
-    if: github.event_name == 'workflow_dispatch'
-    uses: cristalhq/.github/.github/workflows/release.yml@main
-    with:
-      tag: ${{ github.event.input.tag }}
+  vuln:
+    uses: cristalhq/.github/.github/workflows/vuln.yml@v0.6.0