diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..f1a05fc
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,4 @@
+# Default owners for everything in this repo. The DevOps team is requested for
+# review on all changes. Requires the @getoptimum/devops team to have write
+# access to the repository for review requests to be assigned.
+* @getoptimum/devops
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd0158c..5c11e68 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,9 +28,9 @@ jobs:
     steps:
       # Action versions pinned to commit SHAs (tag in the comment) per the
       # OpenSSF / GitHub-hardening guidance used across this repo's workflows.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 7956400..7cbb688 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,9 +31,9 @@ jobs:
       # human-readable tag) per OpenSSF / GitHub-hardening guidance —
       # version tags are mutable and an attacker who gains write on the
       # action repo can re-point the tag at malicious code.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-      - uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..dc0bb04
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,34 @@
+# Security Policy
+
+## Reporting a vulnerability
+
+Please report security issues privately. Do not open a public issue or pull
+request for a suspected vulnerability.
+
+- Preferred: open a private report through GitHub Security Advisories, via the
+  repository's "Security" tab, then "Report a vulnerability".
+- Alternatively, email security@getoptimum.xyz.
+
+Include enough detail to reproduce the issue: the affected version, the steps,
+and the impact. We will acknowledge your report and keep you updated through to
+a fix.
+
+## Supported versions
+
+Security fixes are released against the latest 1.x version. Upgrade with
+`pip install -U optimum-keysync`.
+
+## How keysync handles secrets
+
+keysync authenticates with an `ovi_live_*` operator API key, which is the only
+secret it uses:
+
+- The key is presented only as a Bearer token over HTTPS. keysync refuses
+  non-HTTPS API and auth URLs (loopback excepted, for local dev) and rejects
+  URLs that embed credentials, so the key is not sent in cleartext.
+- No token is cached or persisted; revoking the key in the partners dashboard
+  takes effect on the next run.
+- keysync never writes the key to disk and never logs it.
+
+Keep the key out of shell history and version control: supply it through an
+environment variable or a secret manager.