diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..6cc0071
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/php-cs-fixer.yml b/.github/workflows/php-cs-fixer.yml
index d72cd8b..0fcd812 100644
--- a/.github/workflows/php-cs-fixer.yml
+++ b/.github/workflows/php-cs-fixer.yml
@@ -14,10 +14,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
         with:
           php-version: 8.3
           extensions: dom, curl, libxml, mbstring, zip, pcntl, bcmath, intl, iconv
@@ -29,7 +29,7 @@ jobs:
           echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT
 
       - name: Cache dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
           key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 034dfce..d8ce724 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -15,8 +15,8 @@ jobs:
       matrix:
         dependency-version: [ stable, lowest ]
         os: [ ubuntu, windows ]
-        laravel: [ 11.*, 12.*, 13.* ]
-        php: [ 8.3, 8.4 ]
+        laravel: [ 12.*, 13.* ]
+        php: [ 8.3, 8.4, 8.5 ]
     
     runs-on: "${{ matrix.os }}-latest"
     timeout-minutes: 10
@@ -25,10 +25,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
         with:
           php-version: ${{ matrix.php }}
           extensions: dom, curl, libxml, mbstring, zip, pcntl, bcmath, intl, iconv, fileinfo
@@ -40,7 +40,7 @@ jobs:
           echo "dir=$(composer config cache-files-dir)" >> $GITHUB_OUTPUT  
 
       - name: Cache dependencies
-        uses: actions/cache@v5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: ${{ steps.composer-cache.outputs.dir != '' }}
         with:
           path: ${{ steps.composer-cache.outputs.dir }}
diff --git a/.github/workflows/update-changelog.yml b/.github/workflows/update-changelog.yml
index ff4def3..4f8bf9a 100644
--- a/.github/workflows/update-changelog.yml
+++ b/.github/workflows/update-changelog.yml
@@ -8,18 +8,18 @@ jobs:
   update-publish:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.event.repository.full_name }}
           ref: 'main'
 
       - name: Update changelog
-        uses: thomaseizinger/keep-a-changelog-new-release@v3
+        uses: thomaseizinger/keep-a-changelog-new-release@f62c3c390716df5af712ba5d94f4f4a8efc1306d # v3.1.0
         with:
           version: ${{ github.event.release.tag_name }}
 
       - name: Commit changelog back to repo
-        uses: EndBug/add-and-commit@v9
+        uses: EndBug/add-and-commit@cc9c08ba6c8df3b93a8f2db63e89b98368ae2ae8 # v11.1.1
         with:
           add: 'CHANGELOG.md'
           message: ${{ github.event.release.tag_name }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 18b0168..48da9c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,14 @@ format. This project adheres to [Semantic Versioning](https://semver.org/spec/v2
 
 ## [Unreleased]
 
+### Removed
+
+- Dropped support for Laravel 10 and 11 (both are end-of-life). Laravel 12+ and PHP 8.3+ are now required.
+
+### Security
+
+- GitHub Actions are now pinned to commit SHAs, with Dependabot keeping them up to date.
+
 ## [1.1.1] - 2026-03-23
 
 ## [1.1.0] - 2026-01-31
diff --git a/composer.json b/composer.json
index fd2c6e6..262c32a 100755
--- a/composer.json
+++ b/composer.json
@@ -15,14 +15,15 @@
   "type": "library",
   "license": "MIT",
   "require": {
-    "illuminate/support": "^10|^11|^12|^13|dev-main|dev-master",
+    "php": ">=8.3",
+    "illuminate/support": "^12|^13",
     "ext-json": "*"
   },
   "require-dev": {
-    "orchestra/testbench": "^8.34.0|^9.12.0|^10.1.0|^11.0.0|12.x-dev|dev-main|dev-master",
-    "internachi/modular": "*",
+    "orchestra/testbench": "^10.1.0|^11.0.0",
+    "internachi/modular": "^3.0",
     "friendsofphp/php-cs-fixer": "^3.71",
-    "phpunit/phpunit": "^10.5|^11.5|^12.5"
+    "phpunit/phpunit": "^11.5|^12.5|^13.0"
   },
   "autoload": {
     "psr-4": {
@@ -41,6 +42,10 @@
     "fix-style": "vendor/bin/php-cs-fixer fix",
     "check-style": "vendor/bin/php-cs-fixer fix --diff --dry-run"
   },
-  "minimum-stability": "dev",
-  "prefer-stable": true
+  "extra": {
+    "branch-alias": {
+      "dev-main": "1.x-dev"
+    }
+  },
+  "minimum-stability": "stable"
 }