diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..c73a8115
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,7 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 188dbf8e..8bcdfb02 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,9 @@ jobs:
 
     runs-on: ${{ matrix.os }}
 
+    permissions:
+      contents: write
+
     env:
       TAG: "0.3.6"
       AMD64_LINUX_GCC: amd64-linux-gcc
@@ -342,7 +345,7 @@ jobs:
     # --- Upload release artifacts ---
 
     - name: Upload release artifacts
-      uses: softprops/action-gh-release@v1
+      uses: softprops/action-gh-release@v2
       if: startsWith(github.ref, 'refs/tags/v')
       with:
         files: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..cd720725
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,32 @@
+name: codeql
+
+on: workflow_dispatch
+
+jobs:
+  codeql:
+    runs-on: ubuntu-20.04
+    permissions:
+      security-events: write
+
+    steps:
+    - name: Checkout [${{ github.repository }}]
+      uses: actions/checkout@v4
+
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: c
+        build-mode: manual
+
+    - name: Build
+      env:
+        PREFIX: amd64-linux-gcc
+        CC: gcc
+        MAKE: make
+        ARTIFACT_DIR: .artifacts
+        RUN_TESTS: true
+      shell: bash
+      run: ./scripts/ci-build.sh
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3