diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..653fc15
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,14 @@
+name: Dependabot auto-merge
+
+on:
+  pull_request_target: # zizmor: ignore[dangerous-triggers] no checkout, no execution of PR-authored code; only trusted event context is read
+    types: [opened, synchronize, reopened]
+
+jobs:
+  call-workflow-dependabot-auto-merge:
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-dependabot-auto-merge.yml@DEVOPS-1061
+    permissions:
+      contents: write
+      pull-requests: write
+    with:
+      dependabot-group: mirageo-ci-tools
diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml
index 7765352..adeea48 100644
--- a/.github/workflows/issue_to_jira.yml
+++ b/.github/workflows/issue_to_jira.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   call-workflow-create-jira-issue:
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       issues: write
     secrets:
diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml
index 084ddfc..1cc12e9 100644
--- a/.github/workflows/pr_jira_actions.yml
+++ b/.github/workflows/pr_jira_actions.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   call-workflow-pr_jira_actions:
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     permissions:
       contents: read
       pull-requests: write
diff --git a/.github/workflows/python_analysis.yml b/.github/workflows/python_analysis.yml
index 0729d67..62561ae 100644
--- a/.github/workflows/python_analysis.yml
+++ b/.github/workflows/python_analysis.yml
@@ -24,14 +24,14 @@ concurrency:
 jobs:
   call-workflow-static-analysis:
     name: Static analysis
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     with:
       package-manager: 'conda'
       app-name: 'surface_apps'
       python-version: '3.12'
   call-workflow-pytest:
     name: Pytest
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     with:
       package-manager: 'conda'
       python-versions: '["3.12", "3.13"]'
diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml
index 89c5b1d..883bea8 100644
--- a/.github/workflows/python_deploy_dev.yml
+++ b/.github/workflows/python_deploy_dev.yml
@@ -12,7 +12,7 @@ concurrency:
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     with:
       package-name: 'surface-apps'
       python-version: '3.12'
@@ -25,7 +25,7 @@ jobs:
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     with:
       package-manager: 'poetry'
       package-name: 'surface-apps'
diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml
index 5584bdc..0082bad 100644
--- a/.github/workflows/python_deploy_prod.yml
+++ b/.github/workflows/python_deploy_prod.yml
@@ -27,7 +27,7 @@ jobs:
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     with:
       virtual-repo-names: '["public-noremote-conda-prod"]'
       release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -37,7 +37,7 @@ jobs:
   call-workflow-pypi-release:
     name: Publish production PyPI package (JFrog Artifactory, PyPI)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@89672b26b20a657bed31f84496961abc07166a95 # v3.9.1
     with:
       package-name: 'surface-apps'
       virtual-repo-names: '["public-pypi-prod", "pypi"]'