diff --git a/.github/codespell-requirements.in b/.github/codespell-requirements.in
new file mode 100644
index 00000000..1bb55fb1
--- /dev/null
+++ b/.github/codespell-requirements.in
@@ -0,0 +1 @@
+codespell==2.4.1
diff --git a/.github/codespell-requirements.txt b/.github/codespell-requirements.txt
new file mode 100644
index 00000000..9d3a533a
--- /dev/null
+++ b/.github/codespell-requirements.txt
@@ -0,0 +1,4 @@
+codespell==2.4.1 \
+    --hash=sha256:299fcdcb09d23e81e35a671bbe746d5ad7e8385972e65dbb833a2eaac33c01e5 \
+    --hash=sha256:3dadafa67df7e4a3dbf51e0d7315061b80d265f9552ebd699b3dd6834b47e425
+    # via -r .github/codespell-requirements.in
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 7a1f5fae..f719d6b4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,3 +10,12 @@ updates:
       github-actions: {patterns: ["*"]}
     labels: [dependencies, github-actions]
     commit-message: {prefix: ci, include: scope}
+  - package-ecosystem: pip
+    directory: /.github
+    target-branch: develop
+    schedule: {interval: weekly, day: friday}
+    open-pull-requests-limit: 5
+    cooldown: {default-days: 7}
+    groups:
+      python-tools: {patterns: ["*"], update-types: [minor, patch]}
+    commit-message: {prefix: deps, include: scope}
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 334a0238..62663605 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -11,13 +11,16 @@ permissions:
 
 jobs:
   codespell:
+    timeout-minutes: 15
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Install codespell
-        run: pip install codespell==2.4.1
+        run: "python3 -m pip install --only-binary :all: --require-hashes -r .github/codespell-requirements.txt"
 
       - name: Run codespell
         run: codespell --config .codespell.cfg