diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..d912497
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,15 @@
+version: 2
+updates:
+  # The app has no third-party package dependencies today (Package.resolved is
+  # gitignored and never exists at checkout), so there is no Swift manifest to
+  # track. The only pinned versions in the repo are the CI workflow's actions,
+  # which are pinned to commit SHAs — this keeps those SHAs current.
+  #
+  # Add a "swift" ecosystem block here the day a third-party dependency lands
+  # and Package.resolved gets committed.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    commit-message:
+      prefix: "ci"
diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 0000000..75f69d6
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,31 @@
+<!-- Thanks for the pull request. Please fill in what applies and delete what doesn't. -->
+
+## What this changes
+
+<!-- The behaviour that is different after this merges, and why it needed doing. -->
+
+## How it was tested
+
+<!-- Which of these ran, and on what. Device results carry more weight than simulator
+     results for anything involving the keyboard, search, or reminders. -->
+
+- [ ] `swift run coreverify` (52/52 green)
+- [ ] `swift test`
+- [ ] `xcodebuild test` on a simulator
+- [ ] Checked on a physical device
+
+## Non-negotiables
+
+<!-- These are the constraints from README.md and CONTRIBUTING.md. A pull request that
+     breaks one of them cannot be merged whatever else it does. Tick to confirm, or
+     say below which one this touches and why. -->
+
+- [ ] No analytics, no telemetry, no off-device data transmission
+- [ ] Zero-knowledge and encryption-always-on still hold
+- [ ] `kSecAttrSynchronizable: false` on every Keychain item
+- [ ] No changes to the frozen crypto contract bytes in `Sources/CatchlightCore/Crypto/`
+- [ ] No new third-party dependencies
+
+## Anything else
+
+<!-- Screenshots for UI changes, linked issues, follow-up work you deliberately left out. -->
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index abb33e9..ddab604 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: macos-15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Intentionally not pinning the Xcode version — the macos-15 image ships
       # multiple side-by-side Xcodes (16.x and newer). Letting the runner use
@@ -47,7 +47,7 @@ jobs:
       # the same thing). Commit Package.resolved and add it back here the day a
       # third-party dependency lands.
       - name: Cache SwiftPM
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             .build
@@ -73,7 +73,7 @@ jobs:
     runs-on: macos-15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install XcodeGen
         run: brew install xcodegen
@@ -82,7 +82,7 @@ jobs:
         run: xcodegen generate
 
       - name: Cache SwiftPM
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/Library/Caches/org.swift.swiftpm
           key: ${{ runner.os }}-xcode-spm-${{ hashFiles('Package.swift') }}
@@ -111,11 +111,17 @@ jobs:
           # dropped the exact 18.0 runtime (2026-06-15: now ships 18.5 / 18.6 +
           # 26.x), so this is pinned to the lowest available 18.x. Bump again if a
           # future image drops 18.5 too (check the "List available simulators" step).
+          #
+          # ⚠️ These matrix strings ARE the status-check names on branch protection
+          # (e.g. "iOS (xcodebuild test) (platform=iOS Simulator,name=iPhone 16,
+          # OS=18.5)"). Editing one renames its check, and the old name stays
+          # required and never reports — which blocks every merge to main until
+          # branch protection is updated to match. Change both together.
           - 'platform=iOS Simulator,name=iPhone 16,OS=18.5'
           - 'platform=iOS Simulator,name=iPhone 16,OS=latest'
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Intentionally not pinning the Xcode version — the macos-15 image ships
       # multiple side-by-side Xcodes (16.x and newer). Letting the runner use
@@ -135,7 +141,7 @@ jobs:
       # SourcePackages under DerivedData/<Project>-<hash>/), so it restored
       # nothing while costing save/restore time.
       - name: Cache SwiftPM
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ~/Library/Caches/org.swift.swiftpm
           key: ${{ runner.os }}-xcode-spm-${{ hashFiles('Package.swift') }}