diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..a0e3735
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+---
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions" # Check for GitHub Actions updates
+    directory: "/" # The root directory where the Ansible role is located
+    schedule:
+      interval: "monthly" # Check for updates monthly
+    commit-message:
+      prefix: "[ci] "
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8e55d20..f2e5a61 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Run sh-checker
         if: ${{ !cancelled() && steps.deps.conclusion == 'success' }}
-        uses: luizm/action-sh-checker@v0.4.0
+        uses: luizm/action-sh-checker@v0.9.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -62,7 +62,7 @@ jobs:
 
       - name: Cache OpenWrt dependencies
         id: cache
-        uses: actions/cache@v2
+        uses: actions/cache@v3
         env:
           cache-name: cache-openwisp-config-dependencies
         with:
diff --git a/openwisp-config/files/openwisp.agent b/openwisp-config/files/openwisp.agent
index 253752a..ec2f604 100755
--- a/openwisp-config/files/openwisp.agent
+++ b/openwisp-config/files/openwisp.agent
@@ -690,7 +690,10 @@ perform_default_test() {
 		fi
 	done
 	rm $TEST_CHECKSUM
-	return $result
+	# "$result" contains the exit code (integer),
+	# hence does not required to be wrapped in quotes.
+	# shellcheck disable=SC2086
+	return "$result"
 }
 
 # stores unmanaged configuration sections that will be merged