diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3286debbf..9e0adecd3 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,15 +6,21 @@ updates:
       interval: daily
       time: "02:00"
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
   - package-ecosystem: github-actions
     directory: "/"
     schedule:
       interval: daily
       time: "02:00"
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
   - package-ecosystem: docker
     directory: "/"
     schedule:
       interval: daily
       time: "02:00"
     open-pull-requests-limit: 10
+    cooldown:
+      default-days: 7
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 51332469f..38bed57e5 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,18 +1,4 @@
 repos:
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: check-yaml
-      - id: check-toml
-      - id: check-xml
-      - id: check-merge-conflict
-      - id: check-symlinks
-      - id: check-illegal-windows-names
-      - id: mixed-line-ending
-        args: ["--fix=lf"]
-      - id: check-case-conflict
   - repo: https://github.com/python-jsonschema/check-jsonschema
     rev: 0.34.1
     hooks:
@@ -33,6 +19,7 @@ repos:
         args:
           - "--config=.github/zizmor.yml"
           - "--no-progress"
+          - "--fix"
   - repo: https://github.com/shellcheck-py/shellcheck-py
     rev: v0.11.0.1
     hooks:
@@ -44,6 +31,20 @@ repos:
       - id: ruff
         args: ["--exit-non-zero-on-fix"]
       - id: ruff-format
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: check-yaml
+      - id: check-toml
+      - id: check-xml
+      - id: check-merge-conflict
+      - id: check-symlinks
+      - id: check-illegal-windows-names
+      - id: mixed-line-ending
+        args: ["--fix=lf"]
+      - id: check-case-conflict
 
   # Should be the last:
   - repo: meta