diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..2ce0030
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+# Owners must have write access to the repo, otherwise GitHub ignores the line.
+*            @hhvrc @LucHeart
+/SECURITY.md @hhvrc @LucHeart
+/.github/    @hhvrc @LucHeart
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..f3ec771
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,25 @@
+# Security Policy
+
+OpenShock controls devices that people wear, so we take security reports seriously.
+Scope, rules for testing, response times, disclosure and safe harbor are described in the
+**[OpenShock security policy](https://github.com/OpenShock/.github/blob/main/SECURITY.md)**.
+Please read it before testing.
+
+## Reporting a vulnerability
+
+**Do not open a public issue, pull request or Discord thread for a security vulnerability.**
+
+Report it privately through one of these channels:
+
+- [GitHub private vulnerability reporting](https://github.com/OpenShock/OpenShock.org/security/advisories/new) (preferred)
+- Email to [security@openshock.org](mailto:security@openshock.org)
+
+We acknowledge reports within 3 working days (7 days at most), give a triage result within
+14 days, and follow coordinated disclosure with a default deadline of 90 days. OpenShock does not
+pay bounties; reporters are credited in the advisory and in our
+[security acknowledgments](https://github.com/OpenShock/.github/blob/main/SECURITY-ACKNOWLEDGMENTS.md)
+if they wish.
+
+## Supported versions
+
+Only the latest release receives security fixes.
diff --git a/renovate.json b/renovate.json
index 3b65b9e..c0bb297 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,24 +1,4 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended",
-    ":semanticCommitTypeAll(chore)",
-    "helpers:pinGitHubActionDigests",
-    "schedule:weekly"
-  ],
-  "minimumReleaseAge": "3 days",
-  "packageRules": [
-    {
-      "description": "One PR for all non-major npm updates",
-      "matchManagers": ["npm"],
-      "matchUpdateTypes": ["minor", "patch"],
-      "groupName": "npm non-major"
-    },
-    {
-      "description": "One PR for all GitHub Actions updates",
-      "matchManagers": ["github-actions"],
-      "matchDepTypes": ["action"],
-      "groupName": "github-actions"
-    }
-  ]
+  "extends": ["local>OpenShock/org-config//renovate/default", "local>OpenShock/org-config//renovate/automerge"]
 }