diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..4f5db38
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+---
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /.github/
+    schedule:
+      interval: weekly
+    groups:
+      actions-minor:
+        update-types:
+          - minor
+          - patch
diff --git a/.github/workflows/amplify.yml b/.github/workflows/amplify.yml
index 60d74b2..17a1013 100644
--- a/.github/workflows/amplify.yml
+++ b/.github/workflows/amplify.yml
@@ -19,4 +19,4 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v4
       - name: Amplify Runner
-        uses: amplify-security/runner-action@v0.1.0
+        uses: amplify-security/runner-action@926f003f3c9695a93cbc4e2f1e64eb784dcacbfc  # v0.2.0
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 676ac10..09607c4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,7 @@ name: CI
   pull_request: {}
   push:
     branches: ["main"]
+  workflow_dispatch: {}
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
@@ -18,23 +19,46 @@ permissions:
   contents: read
 
 jobs:
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      role: ${{ steps.filter.outputs.role }}
+    steps:
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332  # v4.1.7
+      - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36  # v3.0.2
+        id: filter
+        with:
+          base: ${{ github.ref }}
+          filters: |
+            role:
+              - 'tasks/**'
+              - 'handlers/**'
+              - 'defaults/**'
+              - 'vars/**'
+              - 'files/**'
+              - 'library/**'
+              - 'module_utils/**'
+              - 'Vagrantfile'
   vagrant-deploy:
+    needs: ["changes"]
+    if: ${{ needs.changes.outputs.role == 'true' || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-22.04
     steps:
       - uses: actions/checkout@v4
       - run: sudo apt install nfs-kernel-server
       - run: sudo pipx inject ansible-core jmespath netaddr
       - run: ansible-galaxy install geerlingguy.ntp
+      # yamllint disable rule:line-length
       - name: setup vagrant
         run: |
           # Copyright The containerd Authors
-          # 
+          #
           # Licensed under the Apache License, Version 2.0 (the "License");
           # you may not use this file except in compliance with the License.
           # You may obtain a copy of the License at
-          # 
+          #
           #     http://www.apache.org/licenses/LICENSE-2.0
-          # 
+          #
           # Unless required by applicable law or agreed to in writing, software
           # distributed under the License is distributed on an "AS IS" BASIS,
           # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -50,6 +74,7 @@ jobs:
           sudo apt-get build-dep -y vagrant ruby-libvirt
           sudo apt-get install -y --no-install-recommends libxslt-dev libxml2-dev libvirt-dev ruby-bundler ruby-dev zlib1g-dev
           vagrant plugin install vagrant-libvirt
+      # yamllint enable rule:line-length
       - run: >
           sudo -E -u ${USER}
           ANSIBLE_STDOUT_CALLBACK=debug