diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 3a9b7f76..d0db49bc 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -10,8 +10,12 @@ updates:
     directory: "/"
     patterns: ["*"]
     multi-ecosystem-group: "dependencies"
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: "maven"
     directory: "/"
     patterns: ["*"]
     multi-ecosystem-group: "dependencies"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/broken_links_checker.yml b/.github/workflows/broken_links_checker.yml
index 4e4a837e..ac2be653 100644
--- a/.github/workflows/broken_links_checker.yml
+++ b/.github/workflows/broken_links_checker.yml
@@ -38,7 +38,7 @@ jobs:
             ]
           }
           EOF
-      - uses: tcort/github-action-markdown-link-check@e047c5b37f24ab722bbef1a27b6fab7f96bc4068
+      - uses: tcort/github-action-markdown-link-check@4e4c260e171095fad9a1c53696167469187b72ce # master
         with:
           use-quiet-mode: "yes"
           use-verbose-mode: "no"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 32563638..efd32129 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,10 +33,11 @@ jobs:
 
       - name: Fail if not running on main branch
         if: ${{ github.ref != 'refs/heads/main' }}
-        uses: actions/github-script@v9
-        with:
-          script: |
-            core.setFailed('Not running on main branch, github.ref is ${{ github.ref }}. Please start this workflow only on main')
+        run: |
+          echo "Not running on main branch, github.ref is ${GITHUB_REF}. Please start this workflow only on main."
+          exit 1
+        env:
+          GITHUB_REF: ${{ github.ref }}
 
       - name: Set up Maven Central Repository
         uses: actions/setup-java@v6
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 00000000..785db4c9
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,8 @@
+# See https://docs.zizmor.sh/configuration/#settings
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        "actions/*": ref-pin
+        "github/codeql-action/*": ref-pin
+        "*": hash-pin
diff --git a/doc/changes/changes_4.11.0.md b/doc/changes/changes_4.11.0.md
index 36bc0b7f..2e552e8c 100644
--- a/doc/changes/changes_4.11.0.md
+++ b/doc/changes/changes_4.11.0.md
@@ -1,4 +1,4 @@
-# OpenFastTrace 4.11.0, released 2026-10-??
+# OpenFastTrace 4.11.0, released 2026-10-18
 
 Code name: Configurable Plugins
 
diff --git a/openfasttrace-mc-deployable-parent/pom.xml b/openfasttrace-mc-deployable-parent/pom.xml
index 6df1ce88..305dec63 100644
--- a/openfasttrace-mc-deployable-parent/pom.xml
+++ b/openfasttrace-mc-deployable-parent/pom.xml
@@ -38,7 +38,7 @@ It is maintained separately from the main parent POM for the following reasons:
                     <plugin>
                         <groupId>org.sonatype.central</groupId>
                         <artifactId>central-publishing-maven-plugin</artifactId>
-                        <version>0.11.0</version>
+                        <version>0.12.0</version>
                         <extensions>true</extensions>
                         <configuration>
                             <publishingServerId>central</publishingServerId>
diff --git a/parent/pom.xml b/parent/pom.xml
index 3b1cbe8b..4e7ff0e1 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -537,7 +537,7 @@
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>versions-maven-plugin</artifactId>
-                <version>2.22.0</version>
+                <version>2.23.0</version>
             </plugin>
             <plugin>
                 <!-- Deployment of this module is not required -->