diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 0a24dfe..191adbe 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,13 +4,17 @@ updates:
   directory: "/"
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 2
   commit-message:
     prefix: "ci(github-actions)"
 - package-ecosystem: npm
   directory: "/"
   schedule:
-    interval: "daily"
+    interval: "weekly"
   versioning-strategy: increase
+  cooldown:
+    default-days: 2
   commit-message:
     prefix: "deps"
     prefix-development: "build(deps-dev)"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5c9f44..ad09a59 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -7,8 +7,8 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+# No permissions are required for this workflow
+permissions: {}
 
 jobs:
   test:
@@ -16,6 +16,8 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
     - name: Use Node.js 22
       uses: actions/setup-node@v6
       with:
@@ -27,6 +29,14 @@ jobs:
     - name: Perform Prettier check
       run: npm run prettier:check
 
+    - name: Validate current commit (last commit) with commitlint
+      if: github.event_name == 'push'
+      run: npm run lint:commit -- --last --verbose
+
+    - name: Validate PR commits with commitlint
+      if: github.event_name == 'pull_request'
+      run: npm run lint:commit -- --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
+
     - name: Perform Licenses check
       run: npm run check-licenses
 
diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml
deleted file mode 100644
index d26cc2c..0000000
--- a/.github/workflows/commitlint.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-name: Commit Message Linting
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-
-permissions:
-  contents: read
-  pull-requests: read
-
-jobs:
-  commitlint:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v6
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 52aab6c..6688368 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -12,8 +12,9 @@ permissions:
 jobs:
   pull-request:
     runs-on: ubuntu-24.04
+    environment: release
     steps:
-    - uses: googleapis/release-please-action@v5
+    - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
       id: release
       with:
         token: ${{secrets.GH_OPENUI5BOT}}
diff --git a/.github/workflows/reuse-compliance.yml b/.github/workflows/reuse-compliance.yml
index 7b7119b..ccb2e77 100644
--- a/.github/workflows/reuse-compliance.yml
+++ b/.github/workflows/reuse-compliance.yml
@@ -8,8 +8,8 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+# No permissions are required for this workflow
+permissions: {}
 
 jobs:
   compliance-check:
@@ -18,4 +18,4 @@ jobs:
     steps:
     - uses: actions/checkout@v6
     - name: Execute REUSE Compliance Check
-      uses: fsfe/reuse-action@v6
+      uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
diff --git a/.husky/commit-msg b/.husky/commit-msg
new file mode 100644
index 0000000..cfdf03d
--- /dev/null
+++ b/.husky/commit-msg
@@ -0,0 +1 @@
+npm run lint:commit -- --edit "$1" # Lint currently edited commit message
diff --git a/.husky/pre-push b/.husky/pre-push
deleted file mode 100644
index 9028981..0000000
--- a/.husky/pre-push
+++ /dev/null
@@ -1 +0,0 @@
-npm run hooks:pre-push
diff --git a/.npmrc b/.npmrc
index 3eeeab4..f5bb40b 100644
--- a/.npmrc
+++ b/.npmrc
@@ -2,3 +2,4 @@
 registry=https://registry.npmjs.org/
 lockfile-version=3
 ignore-scripts=true
+allow-git=none
diff --git a/package.json b/package.json
index 80d83af..2734003 100644
--- a/package.json
+++ b/package.json
@@ -26,8 +26,7 @@
   "scripts": {
     "check-licenses": "licensee --errors-only",
     "knip": "knip",
-    "hooks:pre-push": "npm run lint:commit",
-    "lint:commit": "commitlint -e",
+    "lint:commit": "commitlint",
     "prepare": "node ./.husky/skip.js || husky",
     "prettier": "prettier **/.mcp.json **/plugin.json",
     "prettier:write": "npm run prettier -- --write",