diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..ca79ca5b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5ee34a11..050b3923 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -74,6 +74,8 @@ jobs:
       - id: kendex
         if: steps.render-reach.outputs.render_candidate == 'true'
         continue-on-error: true
+        timeout-minutes: 3
+        shell: bash
         env:
           GH_TOKEN: ""
           GITHUB_TOKEN: ${{ github.token }}
@@ -81,6 +83,7 @@ jobs:
       - id: mirror
         if: steps.render-reach.outputs.render_candidate == 'true'
         continue-on-error: true
+        timeout-minutes: 5
         run: kendex source refresh
         working-directory: subject
       - name: Report unavailable render prerequisites
@@ -132,7 +135,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       - name: Check the application
@@ -301,7 +304,7 @@ jobs:
             --results "$NEEDS" --classifier changes \
             --waiver "$WAIVER" --skippable application \
             --lane application=application "${package[@]}"
-      - name: Scan the pull request's commits for credentials
+      - name: secrets (credential scan of the pull request diff)
         if: always() && github.event_name == 'pull_request'
         working-directory: subject
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 36b652dd..e1c1d1d6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -95,7 +95,7 @@ jobs:
         with:
           ref: ${{ env.TAG }}
           persist-credentials: false
-      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6
+      - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
         with:
           bun-version-file: .bun-version
       # Setting the version is a manual step of the release procedure in
diff --git a/scripts/ci_workflow_test.py b/scripts/ci_workflow_test.py
index 5bcaa8f9..980043fc 100644
--- a/scripts/ci_workflow_test.py
+++ b/scripts/ci_workflow_test.py
@@ -261,6 +261,12 @@ def check_wiring(self, workflow):
             self.assertEqual(shlex.split(command(self.step(changes, header)))[0], executable)
         for header in ("id: kendex", "id: mirror"):
             self.assertEqual(scalar(self.step(changes, header), "if"), "steps.render-reach.outputs.render_candidate == 'true'")
+        # Unbounded, a hung install or refresh runs to the job's timeout and
+        # fails the whole changes job, where continue-on-error would have let
+        # the classifier run on.
+        kendex = self.step(changes, "id: kendex")
+        self.assertEqual((scalar(kendex, "timeout-minutes"), scalar(kendex, "shell")), ("3", "bash"))
+        self.assertEqual(scalar(self.step(changes, "id: mirror"), "timeout-minutes"), "5")
         classify = self.step(changes, "id: classify")
         self.assertEqual(scalar(classify, "uses"), ACTION)
         # The lane declaration comes from the default branch's checkout, and
@@ -274,6 +280,9 @@ def test_classifier_and_render_prerequisites_use_the_trusted_checkout(self):
             ("covers-all-lanes", "          lanes-from: classifier\n", "          lanes-from: classifier\n          covers-all-lanes: true\n"),
             ("lanes-from-subject", "lanes-from: classifier", "lanes-from: subject"),
             ("render-reach-subject", "classifier/.agents/skills/harness-ci/scripts/harness-only", "subject/.agents/skills/harness-ci/scripts/harness-only"),
+            ("kendex-timeout", "        timeout-minutes: 3\n", "        timeout-minutes: 30\n"),
+            ("kendex-shell", "        shell: bash\n", "        shell: sh\n"),
+            ("mirror-timeout", "        timeout-minutes: 5\n        run: kendex source refresh\n", "        timeout-minutes: 50\n        run: kendex source refresh\n"),
         )
         for control, old, new in controls:
             with self.subTest(control=control):