diff --git a/.github/actions/setup-node/action.yml b/.github/actions/setup-node/action.yml
index 2d886ed..60ae19e 100644
--- a/.github/actions/setup-node/action.yml
+++ b/.github/actions/setup-node/action.yml
@@ -7,7 +7,7 @@ runs:
       with:
         node-version-file: .node-version
         package-manager-cache: false
-    - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6
+    - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
       with:
         run_install: false
         cache: true
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..832f799
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,31 @@
+# See origin89hq/engineering docs/dependencies.md.
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directories: [/, /.github/actions/setup-node]
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    commit-message:
+      prefix: ci
+
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    # At least pnpm's minimumReleaseAge, or the frozen install rejects the update.
+    cooldown:
+      default-days: 7
+    groups:
+      npm:
+        patterns: ["*"]
+        update-types: [minor, patch]
+    commit-message:
+      prefix: chore
+      include: scope
diff --git a/.github/workflows/origin89-security.yml b/.github/workflows/origin89-security.yml
new file mode 100644
index 0000000..408bd69
--- /dev/null
+++ b/.github/workflows/origin89-security.yml
@@ -0,0 +1,47 @@
+# See origin89hq/engineering docs/dependencies.md.
+name: origin89-security
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  # New advisories arrive without a code change.
+  schedule:
+    - cron: "17 6 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          fail-on-severity: moderate
+          fail-on-scopes: runtime, development
+          # Checked only for dependencies the pull request adds. Unknown
+          # licenses are reported without failing.
+          allow-licenses: >-
+            0BSD, Apache-2.0, BlueOak-1.0.0, BSD-2-Clause, BSD-3-Clause,
+            CC-BY-4.0, CC0-1.0, ISC, MIT, MPL-2.0, Python-2.0, Unicode-3.0,
+            Unlicense, Zlib
+
+  zizmor:
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        with:
+          version: 1.30.1
+          advanced-security: false
+          annotations: true
+          min-severity: medium
diff --git a/.github/workflows/publish-cloud.yml b/.github/workflows/publish-cloud.yml
index 027632d..6beabb4 100644
--- a/.github/workflows/publish-cloud.yml
+++ b/.github/workflows/publish-cloud.yml
@@ -30,7 +30,7 @@ jobs:
         with:
           node-version-file: .node-version
           package-manager-cache: false
-      - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           run_install: false
       - run: pnpm install --frozen-lockfile --ignore-scripts
@@ -56,7 +56,7 @@ jobs:
         with:
           node-version-file: .node-version
           package-manager-cache: false
-      - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           run_install: false
       - run: pnpm install --frozen-lockfile
@@ -85,7 +85,7 @@ jobs:
         with:
           node-version-file: .node-version
           package-manager-cache: false
-      - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           run_install: false
       - run: pnpm install --frozen-lockfile
@@ -114,7 +114,7 @@ jobs:
         with:
           node-version-file: .node-version
           package-manager-cache: false
-      - uses: pnpm/action-setup@f520eceda224fe1a4aed5a2a27a194379a409996 # v6
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6
         with:
           run_install: false
       - run: pnpm install --frozen-lockfile --ignore-scripts