diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..aac8031
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule: {interval: weekly}
+    open-pull-requests-limit: 10
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..f5f690d
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,45 @@
+name: CodeQL
+on:
+  push:
+  pull_request:
+  schedule:
+    - cron: '23 3 * * 1'
+permissions:
+  contents: read
+  security-events: write
+jobs:
+  detect:
+    runs-on: ubuntu-latest
+    outputs:
+      languages: ${{ steps.lang.outputs.languages }}
+    steps:
+      - uses: actions/checkout@v4
+      - id: lang
+        shell: bash
+        run: |
+          set -euo pipefail
+          langs=''
+          [ -n "$(find . -name '*.py' -print -quit)" ] && langs="$langs python"
+          [ -n "$(find . -name '*.js' -print -quit)" ] || [ -n "$(find . -name '*.ts' -print -quit)" ] && langs="$langs javascript-typescript"
+          [ -f go.mod ] && langs="$langs go"
+          [ -f Cargo.toml ] && langs="$langs rust"
+          [ -f pom.xml ] || [ -f build.gradle ] && langs="$langs java-kotlin"
+          [ -n "$(find . -name '*.c' -print -quit)" ] || [ -n "$(find . -name '*.cpp' -print -quit)" ] && langs="$langs c-cpp"
+          [ -n "$langs" ] || langs=' python'
+          json="$(jq -cn --arg l "$langs" '$l | split(" ") | map(select(length > 0))')"
+          echo "languages=$json" >> "$GITHUB_OUTPUT"
+  analyze:
+    needs: detect
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ${{ fromJSON(needs.detect.outputs.languages) }}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      - uses: github/codeql-action/analyze@v3
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..52a13f9
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,9 @@
+name: Dependency Review
+on: {pull_request:}
+permissions: {contents: read, pull-requests: read}
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/dependency-review-action@v4
+        with: {fail-on-severity: high}