diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7bb64f3
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/pr-preview.yml b/.github/workflows/pr-preview.yml
index cd1fded..68edae4 100644
--- a/.github/workflows/pr-preview.yml
+++ b/.github/workflows/pr-preview.yml
@@ -23,13 +23,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -37,14 +37,16 @@ jobs:
 
       - name: Build and push preview image
         id: image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           push: true
+          build-args: |
+            GIT_SHA=${{ github.sha }}
           tags: ghcr.io/${{ github.repository }}:pr-${{ github.event.pull_request.number }}-${{ github.sha }}
 
       - name: Checkout repo for previews branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           path: gitops
@@ -106,43 +108,57 @@ jobs:
             git push
           fi
 
+      - name: Wait for preview to serve this revision
+        env:
+          PREVIEW_URL: https://pr-${{ github.event.pull_request.number }}.${{ env.PREVIEW_DOMAIN }}
+          EXPECTED_SHA: ${{ github.sha }}
+          TIMEOUT_SECONDS: "900"
+        run: |
+          set -uo pipefail
+          deadline=$((SECONDS + TIMEOUT_SECONDS))
+          while true; do
+            # Cache-buster + no-cache so we never read a stale cached response
+            served=$(curl -fsS --max-time 10 -H 'Cache-Control: no-cache' \
+              "${PREVIEW_URL}/version.txt?t=$(date +%s)" 2>/dev/null | tr -d '[:space:]') || served=""
+            if [ "$served" = "$EXPECTED_SHA" ]; then
+              if curl -fsS --max-time 10 -o /dev/null "${PREVIEW_URL}/"; then
+                echo "Preview at ${PREVIEW_URL} is serving ${EXPECTED_SHA}"
+                break
+              fi
+              echo "Revision matches but index page is not reachable yet"
+            else
+              echo "Preview not ready (served: '${served:-<unreachable>}', expected: ${EXPECTED_SHA})"
+            fi
+            if [ "$SECONDS" -ge "$deadline" ]; then
+              echo "::error::Timed out after ${TIMEOUT_SECONDS}s waiting for ${PREVIEW_URL} to serve ${EXPECTED_SHA}"
+              exit 1
+            fi
+            sleep 10
+          done
+
       - name: Comment preview URL on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           PREVIEW_URL: https://pr-${{ github.event.pull_request.number }}.${{ env.PREVIEW_DOMAIN }}
+          COMMIT_SHA: ${{ github.sha }}
         with:
           script: |
             const marker = '<!-- pr-preview-comment -->';
-            const body = `${marker}\n🚀 Preview deployed: ${process.env.PREVIEW_URL}\n\nFlux will roll this out shortly after this comment appears.`;
-            const { data: comments } = await github.rest.issues.listComments({
+            const body = `${marker}\n🚀 Preview ready: ${process.env.PREVIEW_URL}\n\nVerified: the preview is serving commit ${process.env.COMMIT_SHA}.`;
+            await github.rest.issues.createComment({
               owner: context.repo.owner,
               repo: context.repo.repo,
               issue_number: context.issue.number,
+              body,
             });
-            const existing = comments.find(c => c.body.includes(marker));
-            if (existing) {
-              await github.rest.issues.updateComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                comment_id: existing.id,
-                body,
-              });
-            } else {
-              await github.rest.issues.createComment({
-                owner: context.repo.owner,
-                repo: context.repo.repo,
-                issue_number: context.issue.number,
-                body,
-              });
-            }
 
   cleanup:
     if: github.event.action == 'closed'
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -207,7 +223,7 @@ jobs:
           fi
 
       - name: Comment on PR
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const marker = '<!-- pr-preview-comment -->';
diff --git a/Dockerfile b/Dockerfile
index cdd5373..f052ee7 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,15 @@
-FROM nginxinc/nginx-unprivileged:alpine
+FROM nginx/nginx-unprivileged:1.31.8-alpine3.24-slim@sha256:629d3227f39ec10201345e420e2d9d430e463a9893d374b515a8eb6541e71938
+
+ARG GIT_SHA=unknown
 
 COPY images/ /usr/share/nginx/html/images/
 COPY downloads/ /usr/share/nginx/html/downloads/
 COPY migration/ /usr/share/nginx/html/migration/
 COPY *.html *.css main.js /usr/share/nginx/html/
 
+# Expose the built revision so deployments can be verified (see PR preview workflow).
+COPY <<EOF /usr/share/nginx/html/version.txt
+${GIT_SHA}
+EOF
+
 EXPOSE 8080