diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..6214844
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+
+updates:
+  - package-ecosystem: cargo
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index 2021d44..c5520aa 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -4,6 +4,8 @@ on:
   pull_request:
     paths:
       - benches/**
+      - tools/scripts/benchmarks.sh
+      - tools/scripts/compare-fetch.sh
       - src/**
       - Cargo.lock
       - Cargo.toml
@@ -13,6 +15,8 @@ on:
     branches: [forge]
     paths:
       - benches/**
+      - tools/scripts/benchmarks.sh
+      - tools/scripts/compare-fetch.sh
       - src/**
       - Cargo.lock
       - Cargo.toml
@@ -58,7 +62,7 @@ jobs:
       - name: Benchmark each tool
         env:
           RUNS: ${{ inputs.runs || 100 }}
-        run: benches/run.sh
+        run: tools/scripts/benchmarks.sh
 
       - name: Show results
         run: cat target/benchmarks/summary.md >> "$GITHUB_STEP_SUMMARY"
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 2668a24..cc57f16 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Smoke-test wheel in a clean environment
         shell: bash
-        run: bash scripts/smoke-wheel.sh dist/*.whl
+        run: bash tools/scripts/smoke-wheel.sh dist/*.whl
 
   style:
     name: Rust / style
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 063ecf2..24f1958 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,6 +55,7 @@ jobs:
         uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
         with:
           command: release
+          config: tools/config/release-plz.toml
           dry_run: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -101,7 +102,7 @@ jobs:
           HEAD_REPOSITORY: ${{ github.event.pull_request.head.repo.full_name }}
           MERGED: ${{ github.event.pull_request.merged }}
           REPOSITORY: ${{ github.repository }}
-        run: bash scripts/release.sh authorize-release
+        run: bash tools/scripts/release.sh authorize-release
 
       - name: Create semantic tag and GitHub release
         if: steps.authorize.outputs.authorized == 'true'
@@ -109,6 +110,7 @@ jobs:
         uses: release-plz/action@2eb1d8bcb770b4c48ccfaad919734b38b51958c9 # v0.5.131
         with:
           command: release
+          config: tools/config/release-plz.toml
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -136,7 +138,7 @@ jobs:
         env:
           MANUAL_TAG: ${{ inputs.tag }}
           RELEASES: ${{ needs.semantic.outputs.releases }}
-        run: bash scripts/release.sh select-tag
+        run: bash tools/scripts/release.sh select-tag
 
   metadata:
     name: Validate release
@@ -159,7 +161,7 @@ jobs:
         shell: bash
         env:
           TAG: ${{ needs.select.outputs.tag }}
-        run: bash scripts/release.sh validate-metadata
+        run: bash tools/scripts/release.sh validate-metadata
 
   wheels:
     name: Wheel / ${{ matrix.target }}
@@ -201,7 +203,7 @@ jobs:
 
       - name: Smoke-test wheel in a clean environment
         shell: bash
-        run: bash scripts/smoke-wheel.sh dist/*.whl
+        run: bash tools/scripts/smoke-wheel.sh dist/*.whl
 
       - name: Store wheel
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -239,7 +241,7 @@ jobs:
         shell: bash
         env:
           VERSION: ${{ needs.metadata.outputs.version }}
-        run: bash scripts/release.sh write-checksums
+        run: bash tools/scripts/release.sh write-checksums
 
       - name: Reconcile wheels and checksums
         shell: bash
@@ -247,7 +249,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
           REPOSITORY: ${{ github.repository }}
           TAG: ${{ needs.metadata.outputs.tag }}
-        run: bash scripts/release.sh reconcile-github
+        run: bash tools/scripts/release.sh reconcile-github
 
       - name: Attest wheels
         uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
@@ -306,7 +308,7 @@ jobs:
         shell: bash
         env:
           VERSION: ${{ needs.metadata.outputs.version }}
-        run: bash scripts/release.sh verify-pypi
+        run: bash tools/scripts/release.sh verify-pypi
 
   release-pr:
     name: Prepare next semantic release
@@ -349,4 +351,4 @@ jobs:
           BASE_SHA: ${{ github.event.pull_request.merge_commit_sha }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPOSITORY: ${{ github.repository }}
-        run: bash scripts/release.sh prepare-pr
+        run: bash tools/scripts/release.sh prepare-pr
diff --git a/benches/apps.md b/benches/apps.md
index b05e68e..7e5a86a 100644
--- a/benches/apps.md
+++ b/benches/apps.md
@@ -22,7 +22,7 @@ Run the same benchmark used by CI:
 
 ```sh
 cargo build --release --locked
-RUNS=100 WARMUP=20 bash benches/run.sh
+RUNS=100 WARMUP=20 bash tools/scripts/benchmarks.sh
 ```
 
 Hyperfine JSON, Markdown, and stripped binary sizes are written below ignored
diff --git a/benches/fetch.md b/benches/fetch.md
index 6089d76..5ce921d 100644
--- a/benches/fetch.md
+++ b/benches/fetch.md
@@ -46,13 +46,13 @@ cmake -S research/fastfetch -B research/fastfetch/build -DCMAKE_BUILD_TYPE=Relea
 cmake --build research/fastfetch/build --config Release
 cargo build --release --manifest-path research/macchina/Cargo.toml
 make -C research/cpufetch
-benches/compare-fetch.sh
+tools/scripts/compare-fetch.sh
 ```
 
 Set `FETCH`, `FASTFETCH`, `MACCHINA`, and `CPUFETCH` when binaries live outside
 their documented defaults. Results are written below ignored `target/benchmarks`.
 The system and combined tables used the default `RUNS=500`; the separately
-reported CPU-only comparison used `RUNS=1000 benches/compare-fetch.sh` and its
+reported CPU-only comparison used `RUNS=1000 tools/scripts/compare-fetch.sh` and its
 `target/benchmarks/cpu.json` result. Build flags and available system libraries
 can change competitor features and timings, so compare results only from the
 same host and build session.
diff --git a/benches/games.md b/benches/games.md
index 6a09373..414fa80 100644
--- a/benches/games.md
+++ b/benches/games.md
@@ -19,7 +19,7 @@ for eleven game engines and cross-platform terminal input.
 Run the same benchmark used by CI:
 
 ```sh
-RUNS=100 WARMUP=20 bash benches/run.sh
+RUNS=100 WARMUP=20 bash tools/scripts/benchmarks.sh
 ```
 
 Hyperfine JSON, Markdown, and binary sizes are written to
diff --git a/benches/lazybox.md b/benches/lazybox.md
index 310095b..d3bd822 100644
--- a/benches/lazybox.md
+++ b/benches/lazybox.md
@@ -19,7 +19,7 @@ Run 100 measured launches after 20 warmups and record all three packaged tools:
 
 ```sh
 cargo build --release --locked
-RUNS=100 WARMUP=20 bash benches/run.sh
+RUNS=100 WARMUP=20 bash tools/scripts/benchmarks.sh
 ```
 
 Results and stripped binary sizes are written below `target/benchmarks/`.
diff --git a/benches/science.md b/benches/science.md
index fd421d2..d8d459b 100644
--- a/benches/science.md
+++ b/benches/science.md
@@ -22,7 +22,7 @@ Run the same benchmark used by CI:
 
 ```sh
 cargo build --release --locked
-RUNS=100 WARMUP=20 bash benches/run.sh
+RUNS=100 WARMUP=20 bash tools/scripts/benchmarks.sh
 ```
 
 Hyperfine JSON, Markdown, and stripped binary sizes are written below
diff --git a/benches/screensaver.md b/benches/screensaver.md
index 2cbd6c0..1d6202c 100644
--- a/benches/screensaver.md
+++ b/benches/screensaver.md
@@ -22,7 +22,7 @@ Run the same benchmark used by CI:
 
 ```sh
 cargo build --release --locked
-RUNS=100 WARMUP=20 bash benches/run.sh
+RUNS=100 WARMUP=20 bash tools/scripts/benchmarks.sh
 ```
 
 Hyperfine JSON, Markdown, and stripped binary sizes are written below ignored
diff --git a/docs/CONTRIBUTING.md b/docs/CONTRIBUTING.md
index 7083281..daf73ae 100644
--- a/docs/CONTRIBUTING.md
+++ b/docs/CONTRIBUTING.md
@@ -25,11 +25,11 @@ ShellCheck 0.11.0:
 
 ```sh
 actionlint
-shellcheck scripts/*.sh benches/*.sh
+shellcheck tools/scripts/*.sh
 ```
 
 For a performance change, install Hyperfine 1.20.0 and run
-`benches/run.sh` on the same host before and after. Include the command,
+`tools/scripts/benchmarks.sh` on the same host before and after. Include the command,
 sample count, central result, spread, and binary size in the pull request.
 
 ## Change rules
diff --git a/release-plz.toml b/tools/config/release-plz.toml
similarity index 100%
rename from release-plz.toml
rename to tools/config/release-plz.toml
diff --git a/benches/run.sh b/tools/scripts/benchmarks.sh
similarity index 96%
rename from benches/run.sh
rename to tools/scripts/benchmarks.sh
index 71627e2..d2ee52d 100755
--- a/benches/run.sh
+++ b/tools/scripts/benchmarks.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-project=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+project=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
 runs=${RUNS:-100}
 warmup=${WARMUP:-20}
 output="$project/target/benchmarks"
diff --git a/benches/compare-fetch.sh b/tools/scripts/compare-fetch.sh
similarity index 94%
rename from benches/compare-fetch.sh
rename to tools/scripts/compare-fetch.sh
index c16bda5..7cbb6e4 100755
--- a/benches/compare-fetch.sh
+++ b/tools/scripts/compare-fetch.sh
@@ -1,6 +1,9 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+project=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
+cd "$project"
+
 runs=${RUNS:-500}
 fetch=${FETCH:-target/release/fetch}
 fastfetch=${FASTFETCH:-research/fastfetch/build/fastfetch}
diff --git a/scripts/release.sh b/tools/scripts/release.sh
similarity index 97%
rename from scripts/release.sh
rename to tools/scripts/release.sh
index 1852f91..eb7d34e 100644
--- a/scripts/release.sh
+++ b/tools/scripts/release.sh
@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
-project=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+project=$(CDPATH='' cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
 cd "$project"
 
 fail() {
@@ -134,7 +134,7 @@ prepare_pr() {
     local -a open_branches=()
     : "${BASE_SHA:?}"
     : "${REPOSITORY:?}"
-    release-plz update --config release-plz.toml \
+    release-plz update --config tools/config/release-plz.toml \
         --repo-url "https://github.com/$REPOSITORY"
     if git diff --quiet; then
         echo "release: no unreleased changes"
@@ -159,7 +159,7 @@ prepare_pr() {
         git fetch origin "$branch"
         git switch -c "$branch" --track "origin/$branch"
         git merge --no-edit "$BASE_SHA"
-        release-plz update --config release-plz.toml \
+        release-plz update --config tools/config/release-plz.toml \
             --repo-url "https://github.com/$REPOSITORY"
     elif git ls-remote --exit-code --heads origin "$branch" >/dev/null; then
         fail "$branch already exists; reopen its pull request or remove it explicitly"
diff --git a/scripts/smoke-wheel.sh b/tools/scripts/smoke-wheel.sh
similarity index 100%
rename from scripts/smoke-wheel.sh
rename to tools/scripts/smoke-wheel.sh