diff --git a/.devcontainer/Dockerfile b/.devcontainer/Dockerfile
index 74c6ffc..7a0dcd5 100644
--- a/.devcontainer/Dockerfile
+++ b/.devcontainer/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/base:bookworm
+FROM mcr.microsoft.com/devcontainers/base:bookworm@sha256:17e6cc517b483d1108b333d4c34352b0a21617f0117052e9b259d47113a9dc37
 RUN apt-get update && \
     export DEBIAN_FRONTEND=noninteractive && \
     apt-get -y install \
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c14b2ac
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,43 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /.devcontainer
+    schedule:
+      interval: daily
+    groups:
+      all:
+          applies-to: version-updates
+          patterns:
+              - '*'
+    cooldown:
+      default-days: 5
+      include:
+          - '*'
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      all:
+          applies-to: version-updates
+          patterns:
+              - '*'
+    cooldown:
+      default-days: 5
+      include:
+          - '*'
+
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      all:
+          applies-to: version-updates
+          patterns:
+              - '*'
+    cooldown:
+      default-days: 5
+      include:
+          - '*'
diff --git a/.github/workflows/notify-parent-repo.yml b/.github/workflows/notify-parent-repo.yml
index dec3bca..9aacb17 100644
--- a/.github/workflows/notify-parent-repo.yml
+++ b/.github/workflows/notify-parent-repo.yml
@@ -6,8 +6,13 @@ on:
       - main
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   update:
+    permissions:
+      contents: write  # for Git to git push
     if: github.repository == 'euc-dev/ws1-sdk-uem-android'
     runs-on: ubuntu-latest