diff --git a/.github/scripts/check_coverage.py b/.github/scripts/check_coverage.py
index 1c47da32..c0b26572 100644
--- a/.github/scripts/check_coverage.py
+++ b/.github/scripts/check_coverage.py
@@ -13,16 +13,31 @@
 import xml.etree.ElementTree as ET
 
 
+def _confine(candidate: str, base: str) -> str:
+    """Resolve candidate and confirm it stays within base, rejecting path traversal."""
+    resolved = os.path.realpath(candidate)
+    if resolved != base and not resolved.startswith(base + os.sep):
+        raise ValueError(f"Refusing path outside {base}: {candidate}")
+    return resolved
+
+
 def main() -> int:
     results_dir, floor = sys.argv[1], float(sys.argv[2])
-    reports = glob.glob(os.path.join(results_dir, "**", "coverage.cobertura.xml"), recursive=True)
+    base = os.path.realpath(os.getcwd())
+    try:
+        safe_results_dir = _confine(results_dir, base)
+    except ValueError as error:
+        print(error, file=sys.stderr)
+        return 1
+
+    reports = glob.glob(os.path.join(safe_results_dir, "**", "coverage.cobertura.xml"), recursive=True)
     if not reports:
         print(f"No coverage.cobertura.xml found under {results_dir}", file=sys.stderr)
         return 1
 
     hits: dict[tuple[str, str], int] = {}
     for report in reports:
-        root = ET.parse(report).getroot()
+        root = ET.parse(_confine(report, base)).getroot()
         for class_node in root.iter("class"):
             filename = class_node.get("filename", "")
             for line in class_node.iter("line"):
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
index 2857c7b3..966b3503 100644
--- a/.github/workflows/dependabot-auto-merge.yml
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -13,7 +13,7 @@ jobs:
     steps:
       - name: Fetch Dependabot metadata
         id: meta
-        uses: dependabot/fetch-metadata@v3
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index ee879944..db68aa8d 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -174,7 +174,7 @@ jobs:
 
       - name: Detect breaking API changes
         if: steps.base-spec.outputs.exists == 'true'
-        uses: oasdiff/oasdiff-action/breaking@v0
+        uses: oasdiff/oasdiff-action/breaking@024f6c399f9a21ada1addb0f9a36ce1bfac995f1 # v0.1.6
         with:
           base: "origin/${{ github.base_ref }}:src/Orbit.Api/openapi.json"
           revision: "src/Orbit.Api/openapi.json"