diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..2b5290f
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,3 @@
+# A PR into main needs an approving review from a code owner.
+# Replace with @NombaOSS/maintainers once that team exists.
+* @samaxbytez
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..b397484
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,28 @@
+# Weekly update PRs. A routine update is only proposed once the release is a
+# week old (cooldown); security updates ignore the cooldown.
+version: 2
+updates:
+  # Dev tooling only: the published spec has no dependencies.
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      dev-tooling:
+        patterns: ["*"]
+    commit-message:
+      prefix: chore
+      include: scope
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions:
+        patterns: ["*"]
+    commit-message:
+      prefix: ci