diff --git a/.circleci/config.yml b/.circleci/config.yml
index 4aa420d3f5..aecafd03cd 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -125,7 +125,7 @@ jobs:
   package:
     parameters:
       platform:
-        description: the Linux distribution, with release, e.g. debian:bookworm, fedora:latest
+        description: the Linux distribution, with release, e.g. debian:trixie, fedora:latest
         type: string
       rclass:
         description: the resource class to use, usually arm.medium or medium
@@ -205,7 +205,7 @@ jobs:
         description: the Linux distribution (debian|ubuntu)
         type: string
       release:
-        description: the release name (bookworm|focal|jammy|noble)
+        description: the release name (bookworm|trixie|jammy|noble)
         type: string
       make_target:
         description: the make target to execute during the build
@@ -394,11 +394,11 @@ workflows:
           name: build_debian_bookworm
           dist: debian
           release: bookworm
-      # latest ubuntu uses sanitizers
       - build:
-          name: build_ubuntu_focal
-          dist: ubuntu
-          release: focal
+          name: build_debian_trixie
+          dist: debian
+          release: trixie
+      # latest ubuntu uses sanitizers
       - build:
           name: build_ubuntu_jammy
           dist: ubuntu
@@ -433,10 +433,10 @@ workflows:
           matrix:
             parameters:
               platform:
-                - ubuntu:focal
                 - ubuntu:jammy
                 - ubuntu:noble
                 - debian:bookworm
+                - debian:trixie
                 - almalinux:8
                 - almalinux:9
                 - fedora:latest
diff --git a/.circleci/make-deb-packages.sh b/.circleci/make-deb-packages.sh
index 2f05e99d2c..7487a17080 100755
--- a/.circleci/make-deb-packages.sh
+++ b/.circleci/make-deb-packages.sh
@@ -12,7 +12,7 @@ echo "PARAM_DIST: $PARAM_DIST"
 
 
 if [ -z "$PARAM_RELEASE" ]; then
-    echo "Env variable PARAM_RELEASE is not set! For example PARAM_RELEASE=focal for Ubuntu 20.04"
+    echo "Env variable PARAM_RELEASE is not set! For example PARAM_RELEASE=jammy for Ubuntu 22.04"
     exit 1
 elif [ -z "$PARAM_DIST" ]; then
     echo "Env variable PARAM_DIST is not set! For example PARAM_DIST=debian"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..3067dd722b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown: # applies only to version-updates (not security-updates)
+      default-days: 7
+      semver-minor-days: 14 # wait 14 days before applying minor updates
+      semver-major-days: 28
+  - package-ecosystem: gitsubmodule
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 4895b0ffcb..8b37f6814d 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -20,7 +20,7 @@ jobs:
         dry-run: false
         language: c
     - name: Upload Crash
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 3c3d28a001..ea05bd2b74 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -12,7 +12,7 @@ jobs:
     steps:
       - run: |
           sudo apt-get update
-          sudo apt-get install -y \
+          sudo apt-get install --no-install-recommends -y \
             autoconf \
             automake \
             build-essential \
@@ -26,12 +26,12 @@ jobs:
             libunwind-dev \
             pkg-config \
             python3-sphinx
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           submodules: true
       - run: ./autogen.sh
       - run: ./configure --with-persistent-storage
-      - uses: vapier/coverity-scan-action@v1.8.0
+      - uses: vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85 # v1.8.0
         with:
           project: varnish
           email: varnish-dev@varnish-cache.org