diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index d8044c7..8ad8a82 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -1,23 +1,26 @@
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "monthly"
+  - package-ecosystem: github-actions
+    directory: /
     groups:
       ci:
-        patterns:
-          - "*"
-    commit-message:
-      prefix: "ci"
-
-  - package-ecosystem: "npm"
-    directory: "/"
+        patterns: ["*"]
     schedule:
-      interval: "monthly"
+      interval: cron
+      cronjob: "0 0 1 1,7 *"
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: npm
+    directory: /
     groups:
-      dependencies:
-        patterns:
-          - "*"
-    commit-message:
-      prefix: "build"
+      npm:
+        patterns: ["*"]
+      security:
+        applies-to: security-updates
+        patterns: ["*"]
+    schedule:
+      interval: cron
+      cronjob: "0 0 1 1,7 *"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-and-deploy.yaml b/.github/workflows/build-and-deploy.yaml
deleted file mode 100644
index 75201bc..0000000
--- a/.github/workflows/build-and-deploy.yaml
+++ /dev/null
@@ -1,30 +0,0 @@
-name: build-and-deploy
-
-on:
-  workflow_call:
-
-jobs:
-  build-and-deploy:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Build
-        run: npm run build
-
-      - name: Publish to GitHub Pages
-        uses: crazy-max/ghaction-github-pages@v5
-        with:
-          build_dir: dist/
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
new file mode 100644
index 0000000..02c8145
--- /dev/null
+++ b/.github/workflows/deploy.yaml
@@ -0,0 +1,33 @@
+name: deploy
+
+on:
+  workflow_call:
+
+permissions:
+  contents: write
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Build
+        run: npm run build
+
+      - name: Publish to GitHub Pages
+        uses: crazy-max/ghaction-github-pages@1d6ee9b181a81033a16bd707a1401afa978daab4 # v5.0.0
+        with:
+          build_dir: dist/
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/lint-and-format.yaml b/.github/workflows/lint-and-format.yaml
deleted file mode 100644
index 2cc5cb6..0000000
--- a/.github/workflows/lint-and-format.yaml
+++ /dev/null
@@ -1,26 +0,0 @@
-name: lint-and-format
-
-on:
-  workflow_call:
-
-jobs:
-  lint-and-format:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-
-      - name: Setup Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: 24
-          cache: npm
-
-      - name: Install Dependencies
-        run: npm ci
-
-      - name: Lint & Format
-        run: npm run check
-
-      - name: Compile
-        run: npm run compile
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
new file mode 100644
index 0000000..4ea68a3
--- /dev/null
+++ b/.github/workflows/lint.yaml
@@ -0,0 +1,44 @@
+name: lint
+
+on:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  biome:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Lint & Format
+        run: npm run check
+
+  compile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Setup Node
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        with:
+          node-version: 24
+          cache: npm
+
+      - name: Install Dependencies
+        run: npm ci
+
+      - name: Compile
+        run: npm run compile
diff --git a/.github/workflows/on-pull-request.yaml b/.github/workflows/on-pull-request.yaml
index 7dc9d68..e6b056d 100644
--- a/.github/workflows/on-pull-request.yaml
+++ b/.github/workflows/on-pull-request.yaml
@@ -3,6 +3,9 @@ name: on-pull-request
 on:
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  lint-and-format:
-    uses: ./.github/workflows/lint-and-format.yaml
+  lint:
+    uses: ./.github/workflows/lint.yaml
diff --git a/.github/workflows/on-push-main.yaml b/.github/workflows/on-push-main.yaml
index b6be434..fea1119 100644
--- a/.github/workflows/on-push-main.yaml
+++ b/.github/workflows/on-push-main.yaml
@@ -5,10 +5,13 @@ on:
     branches:
       - main
 
+permissions:
+  contents: read
+
 jobs:
-  lint-and-format:
-    uses: ./.github/workflows/lint-and-format.yaml
+  lint:
+    uses: ./.github/workflows/lint.yaml
 
-  build-and-deploy:
-    needs: lint-and-format
-    uses: ./.github/workflows/build-and-deploy.yaml
+  deploy:
+    needs: lint
+    uses: ./.github/workflows/deploy.yaml