diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..586e006c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "npm" # See documentation for possible values
+    directory: "/" # Location of package manifests
+    schedule:
+      interval: "daily"
+      time: "07:00"
+      timezone: "Pacific/Auckland"
+    assignees:
+      - "kirk-spragg" # Security Champion for DevOps.
+    cooldown:
+      default-days: 4
diff --git a/.github/renovate.json b/.github/renovate.json
index ed589085..e63ccfa7 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -6,23 +6,26 @@
   "postUpdateOptions": ["pnpmDedupe"],
   "lockFileMaintenance": {
     "enabled": true,
-    "automerge": true,
+    "automerge": false,
     "schedule": ["every 3 months on the first day of the month"]
   },
+  "minimumReleaseAge": "4 days",
+  "prCreation": "not-pending",
   "packageRules": [
     {
       "matchDepTypes": ["devDependencies"],
-      "automerge": true
+      "automerge": false
     },
     {
       "matchUpdateTypes": ["minor", "patch", "pin", "digest"],
-      "automerge": true
+      "automerge": false
+    },
+    {
+      "matchUpdateTypes": ["major"]
     }
   ],
   "vulnerabilityAlerts": {
-    "labels": ["dependencies", "security"],
-    "automerge": true,
-    "schedule": ["at any time"],
-    "minimumReleaseAge": null
+    "labels": ["security"],
+    "automerge": false
   }
 }
diff --git a/.github/workflows/action.yml b/.github/workflows/action.yml
index 19678949..b7afe3b3 100644
--- a/.github/workflows/action.yml
+++ b/.github/workflows/action.yml
@@ -19,10 +19,10 @@ jobs:
         id: return_dispatch
         uses: ./
         with:
-          token: ${{ secrets.TOKEN }}
+          token: ${{ secrets.GITHUB_TOKEN }}
           ref: ${{ env.TARGET_BRANCH }}
           repo: return-dispatch
-          owner: codex-
+          owner: seequent
           workflow: dispatch.yml
           workflow_inputs: '{"cake":"delicious"}'
       - name: Evaluate that the Run ID output has been set
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 17614163..0a655f6f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,4 +1,6 @@
 name: Build
+permissions:
+  contents: read
 on:
   pull_request:
   push: