diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..787880ee2
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,23 @@
+version: 2
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown: # applies only to version-updates (not security-updates)
+      semver-patch: 7 # wait 7 days before applying patch updates
+      semver-minor: 14
+      semver-major: 28
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    # https://blog.yossarian.net/2025/11/21/We-should-all-be-using-dependency-cooldowns
+    cooldown:
+      default-days: 7
+  - package-ecosystem: gitsubmodule
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 3e2236cc4..e25e63b37 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -25,7 +25,7 @@ jobs:
             target: x86_64-apple-darwin
             nobgt: 0
             no_tests: 1
-            tag: macos-13
+            tag: macos-15-intel
           - name: x86_64-unknown-linux-gnu (nightly)
             target: x86_64-unknown-linux-gnu
             nobgt: 0
@@ -60,7 +60,7 @@ jobs:
       NO_JEMALLOC_TESTS: ${{ matrix.no_tests }}
       NOBGT: ${{ matrix.nobgt }}
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         submodules: true
     - name: install
@@ -81,7 +81,7 @@ jobs:
     name: Benchmarks using x86_64-unknown-linux-gnu (nightly)
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         submodules: true
     - run: rustup default nightly
@@ -90,7 +90,7 @@ jobs:
     name: Rustfmt and Clippy
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         submodules: true
     - run: rustup component add rustfmt clippy
diff --git a/jemalloc-sys/build.rs b/jemalloc-sys/build.rs
index 4ed46a530..972ac566b 100644
--- a/jemalloc-sys/build.rs
+++ b/jemalloc-sys/build.rs
@@ -153,7 +153,9 @@ fn main() {
     }
     // Disable -Wextra warnings - jemalloc doesn't compile free of warnings with
     // it enabled: https://github.com/jemalloc/jemalloc/issues/1196
-    let compiler = cc::Build::new().extra_warnings(false).get_compiler();
+    let mut build = cc::Build::new();
+    let build = build.extra_warnings(false);
+    let (compiler, archiver) = (build.get_compiler(), build.get_archiver());
     let cflags = compiler
         .args()
         .iter()
@@ -161,6 +163,7 @@ fn main() {
         .collect::<Vec<_>>()
         .join(" ");
     info!("CC={:?}", compiler.path());
+    info!("AR={:?}", archiver.get_program());
     info!("CFLAGS={:?}", cflags);
 
     assert!(out_dir.exists(), "OUT_DIR does not exist");
@@ -196,6 +199,7 @@ fn main() {
     )
     .current_dir(&build_dir)
     .env("CC", compiler.path())
+    .env("AR", archiver.get_program())
     .env("CFLAGS", cflags.clone())
     .env("LDFLAGS", cflags.clone())
     .env("CPPFLAGS", cflags)