diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..8d77e584
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    open-pull-requests-limit: 10
+    directory: "/"
+    schedule:
+      interval: "daily"
+    labels:
+      - "dependencies"
+      - "bot"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2822090e..b3739f1b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,13 +31,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Expose GitHub Runtime
-        uses: crazy-max/ghaction-github-runtime@v2
+        uses: crazy-max/ghaction-github-runtime@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Warm cache
         run: |
@@ -60,13 +60,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Expose GitHub Runtime
-        uses: crazy-max/ghaction-github-runtime@v2
+        uses: crazy-max/ghaction-github-runtime@v3
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Run
         run: |
@@ -88,14 +88,14 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Test buildkit
         if: matrix.target == 'buildkit'
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v4
         with:
           targets: buildkit-test
           set: |
@@ -103,7 +103,7 @@ jobs:
       -
         name: Load mainline for testing
         if: matrix.target == 'mainline'
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v4
         with:
           targets: mainline
           load: true
@@ -157,13 +157,13 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Load for testing
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v4
         with:
           targets: ${{ matrix.target }}
           load: true
@@ -209,11 +209,11 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REPO_SLUG }}
           tags: |
@@ -227,23 +227,23 @@ jobs:
           bake-target: meta-helper
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
         with:
           config: .github/buildkit.toml
           buildkitd-flags: --allow-insecure-entitlement=security.insecure
       -
         name: Login to DockerHub
         if: startsWith(github.ref, 'refs/heads/')
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         with:
           username: ${{ secrets.DOCKERIO_USERNAME }}
           password: ${{ secrets.DOCKERIO_PASSWORD }}
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
       -
         name: Build ${{ matrix.target }}
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v4
         with:
           files: |
             ./docker-bake.hcl
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0760ad13..2d44eff2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       -
         name: Prepare
         id: prep
@@ -62,7 +62,7 @@ jobs:
       -
         name: Docker meta
         id: meta
-        uses: docker/metadata-action@v4
+        uses: docker/metadata-action@v5
         with:
           images: ${{ env.REPO_SLUG }}
           tags: |
@@ -78,22 +78,22 @@ jobs:
           bake-target: meta-helper
       -
         name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
+        uses: docker/setup-qemu-action@v3
         with:
           image: ${{ env.REPO_SLUG }}:master
       -
         name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+        uses: docker/setup-buildx-action@v3
       -
         name: Login to DockerHub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v3
         if: github.event.inputs.dry-run != 'true'
         with:
           username: ${{ secrets.DOCKERIO_USERNAME }}
           password: ${{ secrets.DOCKERIO_PASSWORD }}
       -
         name: Build image
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v4
         with:
           files: |
             ./docker-bake.hcl
@@ -109,7 +109,7 @@ jobs:
           QEMU_VERSION: ${{ steps.prep.outputs.ref }}
       -
         name: Build artifacts
-        uses: docker/bake-action@v2
+        uses: docker/bake-action@v4
         if: github.event.inputs.target == 'mainline'
         with:
           files: |
@@ -130,7 +130,7 @@ jobs:
           mv ./bin/**/* ./bin/
       -
         name: Create Release
-        uses: softprops/action-gh-release@9729932bfb75c05ad1f6e3a729294e05abaa7001
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844  # v0.1.15
         if: github.event.inputs.dry-run != 'true'
         with:
           name: ${{ steps.prep.outputs.git_tag }}
diff --git a/README.md b/README.md
index 81d54e62..f17feebe 100644
--- a/README.md
+++ b/README.md
@@ -1,8 +1,9 @@
 # Binfmt
 
-[![CI Status](https://github.com/tonistiigi/binfmt/actions/workflows/ci.yml/badge.svg)](https://github.com/tonistiigi/binfmt/actions/workflows/ci.yml)
-[![Go Report Card](https://goreportcard.com/badge/github.com/tonistiigi/binfmt)](https://goreportcard.com/report/github.com/tonistiigi/binfmt)
-[![Docker Pulls](https://img.shields.io/docker/pulls/tonistiigi/binfmt.svg?logo=docker)](https://hub.docker.com/r/tonistiigi/binfmt/)
+[![GitHub release](https://img.shields.io/github/release/tonistiigi/binfmt.svg?style=flat-square)](https://github.com/tonistiigi/binfmt/releases/latest)
+[![CI Status](https://img.shields.io/github/actions/workflow/status/tonistiigi/binfmt/ci.yml?label=ci&logo=github&style=flat-square)](https://github.com/tonistiigi/binfmt/actions?query=workflow%3Aci)
+[![Go Report Card](https://goreportcard.com/badge/github.com/tonistiigi/binfmt?style=flat-square)](https://goreportcard.com/report/github.com/tonistiigi/binfmt)
+[![Docker Pulls](https://img.shields.io/docker/pulls/tonistiigi/binfmt.svg?style=flat-square&logo=docker)](https://hub.docker.com/r/tonistiigi/binfmt/)
 
 Cross-platform emulator collection distributed with Docker images.