diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..4223440
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    versioning-strategy: widen
+    groups:
+      development-dependencies:
+        dependency-type: "development"
+      production-dependencies:
+        dependency-type: "production"
+        update-types:
+          - "minor"
+          - "patch"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
deleted file mode 100644
index d9ca134..0000000
--- a/.github/workflows/code-quality.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Code Quality
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - '**'
-
-jobs:
-  pre-commit:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v5
-    - uses: pre-commit/action@v2.0.0
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 7cf66fe..5188dd6 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -9,30 +9,44 @@ on:
       - '**'
 
 jobs:
+  pre-commit:
+    name: Code Quality
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
+
   tests:
     name: ${{ matrix.os }} / ${{ matrix.python-version }}
     runs-on: ${{ matrix.os }}-latest
     continue-on-error: ${{ matrix.experimental }}
+    needs: [ pre-commit ]
     strategy:
       matrix:
-        os: [Ubuntu]
-        python-version: ["3.10", "3.11", "3.12", "3.13"]
-        experimental: [false]
+        os: [ ubuntu, windows, macos ]
+        python-version: [ "3.10", "3.11", "3.12", "3.13" ]
+        experimental: [ false ]
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/setup-go@41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed # v5
+        with:
+          go-version: '^1.23.0'
+          cache-dependency-path: "Makefile"
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Get full python version
         id: full-python-version
         shell: bash
-        run: echo ::set-output name=version::$(python -c "import sys; print('-'.join(str(v) for v in sys.version_info))")
+        run: |
+          VERSION=$(python -c "import sys; print('-'.join(str(v) for v in sys.version_info))")
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
 
       - name: Install poetry
         shell: bash
@@ -43,7 +57,7 @@ jobs:
         run: poetry config virtualenvs.in-project true
 
       - name: Set up cache
-        uses: actions/cache@v4
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4
         id: cache
         with:
           path: .venv
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2f9dddb..b64eda2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,14 +11,14 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@ee0669bd1cc54295c223e0bb666b733df41de1c5 # v2
 
       - name: Get tag
         id: tag
-        run: echo ::set-output name=tag::${GITHUB_REF#refs/tags/}
+        run: echo "tag=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
 
       - name: Set up Python 3.13
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5
         with:
           python-version: "3.13"
 
@@ -38,7 +38,7 @@ jobs:
             || echo "::set-output name=prerelease::true"
 
       - name: Create Release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@2c591bcc8ecdcd2db72b97d6147f871fcd833ba5 # v1
         with:
           artifacts: "dist/*"
           token: ${{ secrets.GITHUB_TOKEN }}