diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 77356b1..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-version: 2
-
-updates:
-  # npm dependencies
-  - package-ecosystem: "npm"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "08:00"
-      timezone: "Etc/UTC"
-    open-pull-requests-limit: 5
-    versioning-strategy: "increase"
-    commit-message:
-      prefix: "deps"
-      prefix-development: "deps-dev"
-      include: "scope"
-    groups:
-      typescript-eslint:
-        patterns:
-          - "typescript-eslint"
-          - "@typescript-eslint/*"
-      jest-stack:
-        patterns:
-          - "jest"
-          - "@types/jest"
-          - "ts-jest"
-      types:
-        patterns:
-          - "@types/*"
-        exclude-patterns:
-          - "@types/jest"
-        update-types:
-          - "minor"
-          - "patch"
-      dev-dependencies-minor-patch:
-        dependency-type: "development"
-        update-types:
-          - "minor"
-          - "patch"
-
-  # GitHub Actions
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-      day: "monday"
-      time: "08:00"
-      timezone: "Etc/UTC"
-    open-pull-requests-limit: 3
-    commit-message:
-      prefix: "ci"
-      include: "scope"
-    groups:
-      actions:
-        patterns:
-          - "*"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
deleted file mode 100644
index e45dbd3..0000000
--- a/.github/workflows/scorecard.yml
+++ /dev/null
@@ -1,57 +0,0 @@
-name: Scorecard supply-chain security
-
-on:
-  branch_protection_rule:
-  schedule:
-    - cron: "30 6 * * 1"
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions: read-all
-
-jobs:
-  analysis:
-    name: Scorecard analysis
-    runs-on: ubuntu-latest
-
-    permissions:
-      security-events: write
-      id-token: write
-      contents: read
-      actions: read
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
-        with:
-          results_file: results.sarif
-          results_format: sarif
-          # Only publish to the public OpenSSF database from main / scheduled
-          # runs; PR runs are gating-only so they don't pollute the score.
-          publish_results: ${{ github.event_name != 'pull_request' }}
-
-      - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: SARIF file
-          path: results.sarif
-          retention-days: 5
-
-      # Code-scanning SARIF upload only runs on push/schedule. On PRs the
-      # token does not have `security-events: write` for fork PRs and the
-      # alert UI is meant to track main-branch state.
-      - name: Upload to code-scanning
-        if: github.event_name != 'pull_request'
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
-        with:
-          sarif_file: results.sarif
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1510c38..d81800d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,7 +2,19 @@
 
 ## [Unreleased]
 
-## [0.5.3] - 2026-05-05
+## [0.5.4] - 2026-05-12
+
+### Removed
+
+- Dependabot is fully removed from the repository. The `.github/dependabot.yml` configuration is deleted, all open Dependabot PRs are closed, and Dependabot vulnerability alerts / automated security updates are disabled at the repo level. Action and dependency bumps will be done manually going forward (`.github/dependabot.yml`)
+- OpenSSF Scorecard supply-chain analysis workflow removed (`.github/workflows/scorecard.yml`)
+- OpenSSF Scorecard and OpenSSF Best Practices badges removed from the README (`README.md`)
+
+### Docs
+
+- `CLAUDE.md` rewritten to drop OpenSSF Scorecard references in the CI conventions, security reporting, and branch protection sections. Manual SHA-pin and least-privilege workflow practices remain as they're still sound supply-chain hygiene independent of the OpenSSF program (`CLAUDE.md`)
+
+
 
 ### Docs
 
diff --git a/README.md b/README.md
index bd742fc..50e4924 100644
--- a/README.md
+++ b/README.md
@@ -5,8 +5,6 @@
 [![CI](https://github.com/Hiprax/errors/actions/workflows/ci.yml/badge.svg)](https://github.com/Hiprax/errors/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/Hiprax/errors/branch/main/graph/badge.svg)](https://codecov.io/gh/Hiprax/errors)
 [![CodeQL](https://github.com/Hiprax/errors/actions/workflows/codeql.yml/badge.svg)](https://github.com/Hiprax/errors/actions/workflows/codeql.yml)
-[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/Hiprax/errors/badge)](https://scorecard.dev/viewer/?uri=github.com/Hiprax/errors)
-[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/12757/badge)](https://www.bestpractices.dev/projects/12757)
 
 A small, typed error toolkit for Express.js apps. Zero runtime dependencies.
 
diff --git a/package-lock.json b/package-lock.json
index f0ba4e9..06bc8b5 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "@hiprax/errors",
-  "version": "0.5.1",
+  "version": "0.5.4",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@hiprax/errors",
-      "version": "0.5.1",
+      "version": "0.5.4",
       "license": "MIT",
       "devDependencies": {
         "@arethetypeswrong/cli": "^0.18.2",
diff --git a/package.json b/package.json
index 405d368..e591b6d 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@hiprax/errors",
-  "version": "0.5.3",
+  "version": "0.5.4",
   "description": "A modular error handling solution for Express.js applications.",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",