diff --git a/.forgejo/workflows/integration.yml b/.forgejo/workflows/integration.yml
index 3ca3c0d..13465c0 100644
--- a/.forgejo/workflows/integration.yml
+++ b/.forgejo/workflows/integration.yml
@@ -3,18 +3,20 @@ on:
   push:
     branches:
       - "**"
+    branches-ignore:
+      - renovate/** # they are build via PR
 
 env:
-  FORGEJO_VERSION: 11.0.14 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
+  FORGEJO_VERSION: 11.0.16 # renovate: datasource=docker depName=data.forgejo.org/forgejo/forgejo
 
 jobs:
   integration:
     runs-on: lxc-trixie
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.11
+        uses: https://code.forgejo.org/actions/setup-forgejo@0191c04814b526caf141138a5567000ab08ddae0 # v3.2.0
         with:
           user: testuser
           password: admin1234
diff --git a/.forgejo/workflows/release.yml b/.forgejo/workflows/release.yml
index e3c5bca..672c1a2 100644
--- a/.forgejo/workflows/release.yml
+++ b/.forgejo/workflows/release.yml
@@ -9,7 +9,7 @@ jobs:
 
     steps:
       # needs to be in a different dir, so binary and rna cache don't conflict
-      - uses: https://data.forgejo.org/actions/checkout@v6
+      - uses: https://data.forgejo.org/actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: forgejo-release
 
@@ -21,3 +21,8 @@ jobs:
           verbose: ${{ vars.VERBOSE || 'false' }}
           release-notes-assistant: true
           skip-assets: true
+
+      # extract short version from tag and push as branch
+      - run: git push -f origin $FORGEJO_REF_NAME:${FORGEJO_REF_NAME%%.*}
+        shell: bash
+        working-directory: ./forgejo-release
diff --git a/.forgejo/workflows/tests.yml b/.forgejo/workflows/tests.yml
index 9f55112..05a1395 100644
--- a/.forgejo/workflows/tests.yml
+++ b/.forgejo/workflows/tests.yml
@@ -3,6 +3,8 @@ on:
   push:
     branches:
       - '**'
+    branches-ignore:
+      - renovate/** # they are build via PR
 
 jobs:
   tests:
@@ -11,7 +13,7 @@ jobs:
       image: data.forgejo.org/oci/node:24-trixie
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: lint action-docs
         run: |
diff --git a/README.md b/README.md
index 7140117..a0fac14 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/forgejo-release@v2.12.0
+      - uses: actions/forgejo-release@v2.13.4
         with:
           direction: upload
           url: https://my-forgejo-instance.net
@@ -65,7 +65,7 @@ jobs:
       - uses: actions/checkout@v4
       - name: Generate Changelog
         run: ./generate-changelog.sh > dist/changelog.md
-      - uses: actions/forgejo-release@v2.12.0
+      - uses: actions/forgejo-release@v2.13.4
         with:
           direction: upload
           url: https://my-forgejo-instance.net
@@ -86,7 +86,7 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
-      - uses: actions/forgejo-release@v2.12.0
+      - uses: actions/forgejo-release@v2.13.4
         with:
           direction: download
           url: https://my-forgejo-instance.net
diff --git a/action.yml b/action.yml
index c9a8f42..40338c0 100644
--- a/action.yml
+++ b/action.yml
@@ -63,7 +63,7 @@ runs:
   using: "composite"
   steps:
     - if: ${{ inputs.release-notes-assistant }}
-      uses: actions/cache@v4
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         key: rna-${{ inputs.repo }}
         path: ${{ forge.action_path }}/rna
diff --git a/forgejo-release.sh b/forgejo-release.sh
index 41fdea5..1c01f37 100755
--- a/forgejo-release.sh
+++ b/forgejo-release.sh
@@ -18,7 +18,7 @@ if ${VERBOSE:-false}; then set -x; fi
 : ${DELAY:=10}
 : ${SKIP_ASSETS:=false}
 
-RELEASE_NOTES_ASSISTANT_VERSION=v1.7.1 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
+RELEASE_NOTES_ASSISTANT_VERSION=v1.7.3 # renovate: datasource=forgejo-releases depName=forgejo/release-notes-assistant registryUrl=https://code.forgejo.org
 
 TAG_FILE="$TMP_DIR/tag$$.json"
 TAG_URL=$(echo "$TAG" | sed 's/\//%2F/g')
diff --git a/testdata/nested-upload-download/.forgejo/workflows/test.yml b/testdata/nested-upload-download/.forgejo/workflows/test.yml
index e0f9ab9..52db915 100644
--- a/testdata/nested-upload-download/.forgejo/workflows/test.yml
+++ b/testdata/nested-upload-download/.forgejo/workflows/test.yml
@@ -14,9 +14,9 @@ jobs:
   setup-forgejo:
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - id: forgejo
-        uses: https://code.forgejo.org/actions/setup-forgejo@v3.1.11
+        uses: https://code.forgejo.org/actions/setup-forgejo@0191c04814b526caf141138a5567000ab08ddae0 # v3.2.0
         with:
           user: testuser
           password: admin1234
diff --git a/testdata/release-notes-file/.forgejo/workflows/test.yml b/testdata/release-notes-file/.forgejo/workflows/test.yml
index 03660fe..ff214ad 100644
--- a/testdata/release-notes-file/.forgejo/workflows/test.yml
+++ b/testdata/release-notes-file/.forgejo/workflows/test.yml
@@ -6,7 +6,7 @@ jobs:
   upload-download:
     runs-on: lxc-bookworm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-notes-file
         uses: SELF@vTest
@@ -18,7 +18,7 @@ jobs:
           release-notes-file: upload-dir/RELEASE_NOTES.md
           verbose: true
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-notes-file-takes-precedence
         uses: SELF@vTest
@@ -31,7 +31,7 @@ jobs:
           release-notes-file: upload-dir/RELEASE_NOTES.md
           verbose: true
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-notes
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
index 97db864..7b02877 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg-no-passphrase.yml
@@ -92,7 +92,7 @@ jobs:
     container:
       image: 'data.forgejo.org/oci/node:24-trixie'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/gpg.yml b/testdata/upload-download/.forgejo/workflows/gpg.yml
index ea94668..3c8727f 100644
--- a/testdata/upload-download/.forgejo/workflows/gpg.yml
+++ b/testdata/upload-download/.forgejo/workflows/gpg.yml
@@ -27,7 +27,7 @@ jobs:
   upload-gpg:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest
diff --git a/testdata/upload-download/.forgejo/workflows/test.yml b/testdata/upload-download/.forgejo/workflows/test.yml
index 518e019..acde197 100644
--- a/testdata/upload-download/.forgejo/workflows/test.yml
+++ b/testdata/upload-download/.forgejo/workflows/test.yml
@@ -6,7 +6,7 @@ jobs:
   upload-download:
     runs-on: lxc-bookworm
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - if: ${{ !startsWith(github.ref, 'refs/tags/v') }}
         id: release-upload
         uses: SELF@vTest