diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2390d8c8
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/make_bundle_conda.yml b/.github/workflows/make_bundle_conda.yml
index 225ca5a2..95d37096 100644
--- a/.github/workflows/make_bundle_conda.yml
+++ b/.github/workflows/make_bundle_conda.yml
@@ -339,8 +339,8 @@ jobs:
           KEYCHAIN_PATH="$RUNNER_TEMP/installer-signing.keychain-db"
 
           # import certificate and provisioning profile from secrets
-          echo -n "${{ secrets.APPLE_INSTALLER_CERTIFICATE_BASE64 }}" | base64 --decode --output $INSTALLER_CERTIFICATE_PATH
-          echo -n "${{ secrets.APPLE_APPLICATION_CERTIFICATE_BASE64 }}" | base64 --decode --output $APPLICATION_CERTIFICATE_PATH
+          echo -n "${{ secrets.APPLE_INSTALLER_CERTIFICATE_BASE64 }}" | /usr/bin/base64 --decode --output $INSTALLER_CERTIFICATE_PATH
+          echo -n "${{ secrets.APPLE_APPLICATION_CERTIFICATE_BASE64 }}" | /usr/bin/base64 --decode --output $APPLICATION_CERTIFICATE_PATH
 
           # create temporary keychain
           security create-keychain -p "${{ secrets.TEMP_KEYCHAIN_PASSWORD }}" $KEYCHAIN_PATH