diff --git a/.cspell.json b/.cspell.json
index 31f0a44..fa1d406 100644
--- a/.cspell.json
+++ b/.cspell.json
@@ -20,6 +20,7 @@
   ],
   "ignorePaths": [
     "**/.cspell.json",
+    ".github/dependabot.yml",
     ".gitignore",
     ".pre-commit-config.yaml",
     ".taplo.toml",
@@ -28,7 +29,6 @@
   ],
   "ignoreWords": [
     "Conda",
-    "MAINT",
     "PYPI",
     "PYTHONHASHSEED",
     "bdist",
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c658ead
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+
+multi-ecosystem-groups:
+  lock:
+    assignees: [redeboer]
+    commit-message: { prefix: MAINT }
+    schedule: { interval: quarterly }
+
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    labels: [⬆️ Lock]
+    multi-ecosystem-group: lock
+    patterns: ["*"]
diff --git a/.github/workflows/clean-caches.yml b/.github/workflows/clean-caches.yml
index 2de0c95..1d3abcc 100644
--- a/.github/workflows/clean-caches.yml
+++ b/.github/workflows/clean-caches.yml
@@ -14,9 +14,9 @@ on:
 jobs:
   cleanup:
     name: Remove caches
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-slim
     steps:
-      - uses: ComPWA/actions/clean-caches@v3
+      - uses: ComPWA/actions/clean-caches@v4
         with:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ inputs.ref }}
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 4217fe2..ed00e50 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -16,6 +16,6 @@ on:
 
 jobs:
   lock:
-    uses: ComPWA/actions/.github/workflows/lock.yml@v3
+    uses: ComPWA/actions/.github/workflows/lock.yml@v4
     secrets:
       token: ${{ secrets.PAT }}
diff --git a/.github/workflows/pr-linting.yml b/.github/workflows/pr-linting.yml
index 638dfc1..e15b56f 100644
--- a/.github/workflows/pr-linting.yml
+++ b/.github/workflows/pr-linting.yml
@@ -11,4 +11,4 @@ on:
 
 jobs:
   lint-pr:
-    uses: ComPWA/actions/.github/workflows/pr-linting.yml@v3
+    uses: ComPWA/actions/.github/workflows/pr-linting.yml@v4
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index fed0390..433427a 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -10,13 +10,12 @@ repos:
       - id: check-useless-excludes
 
   - repo: https://github.com/ComPWA/policy
-    rev: 0.7.3
+    rev: 0.8.2
     hooks:
       - id: check-dev-files
         args:
           - --no-cd
           - --keep-issue-templates
-          - --no-python
           - --no-pypi
           - --package-manager=none
           - --repo-name=.github
@@ -34,7 +33,7 @@ repos:
       - id: trailing-whitespace
 
   - repo: https://github.com/ComPWA/prettier-pre-commit
-    rev: v3.4.2
+    rev: v3.8.1
     hooks:
       - id: prettier
 
@@ -50,6 +49,6 @@ repos:
         args: [--in-place]
 
   - repo: https://github.com/streetsidesoftware/cspell-cli
-    rev: v9.2.0
+    rev: v9.6.0
     hooks:
       - id: cspell
diff --git a/README.md b/README.md
index 8b0cbc4..ab08e6a 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 # Public ComPWA GitHub profile
 
 [![pre-commit.ci status](https://results.pre-commit.ci/badge/github/ComPWA/.github/main.svg)](https://results.pre-commit.ci/latest/github/ComPWA/.github/main)
-[![Spelling checked](https://img.shields.io/badge/cspell-checked-brightgreen.svg)](https://github.com/streetsidesoftware/cspell/tree/master/packages/cspell)
+[![Spelling checked](https://img.shields.io/badge/cspell-checked-brightgreen.svg)](https://github.com/streetsidesoftware/cspell/tree/main/packages/cspell)
 [![code style: prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg?style=flat-square)](https://github.com/prettier/prettier)
 
 This repository manages the GitHub profile and repository templates for the [ComPWA Organization](https://github.com/ComPWA).