diff --git a/base b/base
index 85a7806..e5a5b53 160000
--- a/base
+++ b/base
@@ -1 +1 @@
-Subproject commit 85a7806ac51cd1d83dc9882d35055d5d696da552
+Subproject commit e5a5b53934da759de2c26d6cb20085560b6756ea
diff --git a/template/.github/workflows/main.yml b/template/.github/workflows/main.yml
index c02c4b7..bb725d4 100644
--- a/template/.github/workflows/main.yml
+++ b/template/.github/workflows/main.yml
@@ -14,20 +14,20 @@ jobs:
     name: Run `pre-commit`
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-python@v4
-    - uses: pre-commit/action@v3.0.0
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+    - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.0.0
+    - uses: pre-commit/action@646c83fcd040023954eafda54b4db0192ce70507 # v3.0.0
   test:
     name: Run approval tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0      # `copier` prefers full-history clones
           submodules: true
       - name: Debug on runner (When re-run with "Enable debug logging" checked)
         if: runner.debug
-        uses: mxschmitt/action-tmate@v3
+        uses: mxschmitt/action-tmate@a283f9441d2d96eb62436dc46d7014f5d357ac22 # v3.17
         with:
           detached: true
       - name: Install test dependencies
@@ -45,8 +45,8 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: codfish/semantic-release-action@v3
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+      - uses: codfish/semantic-release-action@ee5b4afec556c3bf8b9f0b9cd542aade9e486033 # v3.0.0
         with:
           plugins: |
             [ "@semantic-release/commit-analyzer",
diff --git a/template/.pre-commit-config.yaml b/template/.pre-commit-config.yaml
index 3a44e5b..6cfb3b7 100644
--- a/template/.pre-commit-config.yaml
+++ b/template/.pre-commit-config.yaml
@@ -16,4 +16,5 @@ repos:
         args: ["--verbose"]
       - id: check-renovate
         name: Check Renovate config with check-jsonschema
+        additional_dependencies: [json5==0.9.14]
         args: ["--verbose"]