diff --git a/.github/.cspell/project-dictionary.txt b/.github/.cspell/project-dictionary.txt
index e0bad593..ef713a19 100644
--- a/.github/.cspell/project-dictionary.txt
+++ b/.github/.cspell/project-dictionary.txt
@@ -27,6 +27,7 @@ pluginconf
 ppcle
 prek
 quickinstall
+rclone
 rdme
 rootfs
 sccache
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 10ea2a69..8ef40272 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,6 +1,6 @@
 version: 2
 updates:
-  - package-ecosystem: cargo
+  - package-ecosystem: cargo # zizmor: ignore[dependabot-cooldown] # Unless dependencies are pinned/locked, the effect is limited.
     directory: /
     schedule:
       interval: daily
@@ -14,6 +14,8 @@ updates:
     directory: /
     schedule:
       interval: daily
+    cooldown:
+      default-days: 7
     commit-message:
       prefix: ''
     labels: []
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 63c93770..cf958670 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -258,6 +258,8 @@ jobs:
           release_date="${RELEASE_DATE}"
 
           # Make sure the current revision is same as prepare step.
+          # --unshallow is necessary to successfully push the
+          # "releases/${major_version_tag}" branch in the subsequent step.
           retry git fetch origin --unshallow &>/dev/null
           rev=$(git rev-parse HEAD)
           if [[ "${rev}" != "${PREPARE_REV}" ]]; then
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index 76b9bac6..b5be7c9c 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -2,10 +2,8 @@
 # https://docs.zizmor.sh/configuration/
 
 rules:
-  dependabot-cooldown: { disable: true } # Unless dependencies are pinned/locked, the effect is limited.
   secrets-inherit: { disable: true }
   unpinned-uses:
     config:
       policies:
         taiki-e/*: any
-        '*': ref-pin