diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..755dedf
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,37 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "github-actions"
+    commit-message:
+      prefix: "ci"
+      include: "scope"
+
+  - package-ecosystem: "docker"
+    directory: "/docker"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "docker"
+      include: "scope"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    labels:
+      - "dependencies"
+      - "docker"
+    commit-message:
+      prefix: "docker"
+      include: "scope"
diff --git a/.github/workflows/asan.yml b/.github/workflows/asan.yml
index b69ce46..2f96e29 100644
--- a/.github/workflows/asan.yml
+++ b/.github/workflows/asan.yml
@@ -1,5 +1,9 @@
 name: ASAN
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:
diff --git a/.github/workflows/clang-format.yml b/.github/workflows/clang-format.yml
index 863d7ec..2510668 100644
--- a/.github/workflows/clang-format.yml
+++ b/.github/workflows/clang-format.yml
@@ -1,5 +1,9 @@
 name: Clang-Format Check
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index b90fdfb..e29bc0a 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -1,4 +1,9 @@
 name: Docker
+
+permissions:
+  contents: read
+  pull-requests: read
+
 on: [workflow_dispatch]
 
 jobs:
diff --git a/.github/workflows/frankenphp.yml b/.github/workflows/frankenphp.yml
index b58ccb6..5a1651a 100644
--- a/.github/workflows/frankenphp.yml
+++ b/.github/workflows/frankenphp.yml
@@ -1,5 +1,9 @@
 name: FrankenPHP
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 0f883cd..f152e89 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -1,5 +1,9 @@
 name: Linux
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:
diff --git a/.github/workflows/tsan.yml b/.github/workflows/tsan.yml
index 1363a9c..077149e 100644
--- a/.github/workflows/tsan.yml
+++ b/.github/workflows/tsan.yml
@@ -1,5 +1,9 @@
 name: ThreadSanitizer
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:
diff --git a/.github/workflows/ubsan.yml b/.github/workflows/ubsan.yml
index 4548590..350a37e 100644
--- a/.github/workflows/ubsan.yml
+++ b/.github/workflows/ubsan.yml
@@ -1,5 +1,9 @@
 name: UBSAN
 
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   pull_request: null
   push:
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 3c48fc0..9aed8cd 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -1,4 +1,9 @@
 name: Windows
+
+permissions:
+  contents: read
+  pull-requests: read
+
 on:
   release:
     types: [published]
@@ -11,9 +16,6 @@ on:
   schedule:
     - cron: "30 4 * * *"
 
-permissions:
-  contents: write
-
 jobs:
   get-extension-matrix:
     runs-on: ubuntu-latest
@@ -54,6 +56,8 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     if: ${{ github.event_name == 'release' }}
+    permissions:
+      contents: write
     steps:
       - name: Upload artifact to the release
         uses: php/php-windows-builder/release@e03e5d39879adaeb61ed2225f0f4eae7db8c1df8 #v1.8.1