diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..2b5290f
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,3 @@
+# A PR into main needs an approving review from a code owner.
+# Replace with @NombaOSS/maintainers once that team exists.
+* @samaxbytez
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..95f99f0
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,26 @@
+# Weekly update PRs. A routine update is only proposed once the release is a
+# week old (cooldown); security updates ignore the cooldown.
+version: 2
+updates:
+  # pyproject.toml holds ranges, not pins: only widen one when a new release
+  # falls outside it.
+  - package-ecosystem: pip
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    versioning-strategy: increase-if-necessary
+    commit-message:
+      prefix: "fix(deps)"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci