diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..c6c8ed80
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+# Please see the documentation for all configuration options:
+# https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Dependencies listed in .github/workflows/*.yml
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9f9a1258..7c3af26c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -8,39 +8,66 @@ on:
       - release-*
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
 
   lint:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     steps:
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: stable
-      - uses: actions/checkout@v5
-      - uses: golangci/golangci-lint-action@v9
+          cache: false
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.9
+          version: latest
 
   commit:
-    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pull-requests: read # Needed to list the PR's commits.
+    runs-on: ubuntu-26.04
     # Only check commits on pull requests.
     if: github.event_name == 'pull_request'
     steps:
-      - name: get pr commits
-        id: 'get-pr-commits'
-        uses: tim-actions/get-pr-commits@v1.3.1
-        with:
-          token: ${{ secrets.GITHUB_TOKEN }}
+      - name: check commit subject line length
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+        run: |
+          # Save to a file first, so that a gh failure fails the step (rather
+          # than being masked by jq succeeding on empty input).
+          gh api --paginate --slurp \
+            "/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/commits" \
+            > "$RUNNER_TEMP/commits.json"
 
-      - name: check subject line length
-        uses: tim-actions/commit-message-checker-with-regex@v0.3.2
-        with:
-          commits: ${{ steps.get-pr-commits.outputs.commits }}
-          pattern: '^.{0,72}(\n.*)*$'
-          error: 'Subject too long (max 72)'
+          # A page is an array, and --slurp gives an array of pages, thus
+          # the double iteration. Merge commits are skipped.
+          long=$(jq -r '
+              .[][]
+              | select(.parents | length <= 1)
+              | (.commit.message | split("\n")[0]) as $subject
+              | select(($subject | length) > 72)
+              | "\(.sha[0:12]) \($subject)"
+            ' "$RUNNER_TEMP/commits.json")
+
+          if [ -z "$long" ]; then
+            echo "All commit subject lines are 72 characters or less."
+            exit 0
+          fi
+
+          while read -r commit; do
+            echo "::error::subject line too long (max 72 characters): $commit"
+          done <<<"$long"
+          exit 1
 
   test:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-26.04
     strategy:
       fail-fast: false
       matrix:
@@ -49,11 +76,14 @@ jobs:
 
     steps:
     - name: checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
     - name: install go ${{ matrix.go-version }}
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: ${{ matrix.go-version }}
+        cache: false
     - name: build
       run: make EXTRA_FLAGS="${{ matrix.race }}"
     - name: test
diff --git a/validate/validate.go b/validate/validate.go
index 82e7b49b..4b2de5dc 100644
--- a/validate/validate.go
+++ b/validate/validate.go
@@ -742,13 +742,13 @@ func isStruct(t reflect.Type) bool {
 }
 
 func isStructPtr(t reflect.Type) bool {
-	return t.Kind() == reflect.Ptr && t.Elem().Kind() == reflect.Struct
+	return t.Kind() == reflect.Pointer && t.Elem().Kind() == reflect.Struct
 }
 
 func checkMandatoryUnit(field reflect.Value, tagField reflect.StructField, parent string) (errs error) {
 	mandatory := !strings.Contains(tagField.Tag.Get("json"), "omitempty")
 	switch field.Kind() {
-	case reflect.Ptr:
+	case reflect.Pointer:
 		if mandatory && field.IsNil() {
 			errs = multierror.Append(errs, fmt.Errorf("'%s.%s' should not be empty", parent, tagField.Name))
 		}
diff --git a/validate/validate_test.go b/validate/validate_test.go
index ac24845e..991dbbc3 100644
--- a/validate/validate_test.go
+++ b/validate/validate_test.go
@@ -669,7 +669,7 @@ func TestCheckHooks(t *testing.T) {
 			val: rspec.Spec{
 				Version: "1.0.0",
 				Hooks: &rspec.Hooks{
-					Prestart: []rspec.Hook{
+					Prestart: []rspec.Hook{ //nolint:staticcheck // Ignore SA1019: rspec.Hooks.Prestart is deprecated
 						{
 							Path: "/usr/bin/fix-mounts",
 						},
@@ -682,7 +682,7 @@ func TestCheckHooks(t *testing.T) {
 			val: rspec.Spec{
 				Version: "1.0.0",
 				Hooks: &rspec.Hooks{
-					Prestart: []rspec.Hook{
+					Prestart: []rspec.Hook{ //nolint:staticcheck // Ignore SA1019: rspec.Hooks.Prestart is deprecated
 						{
 							Path: "usr",
 						},