diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 77242e6..455c71b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,12 +12,11 @@ jobs:
   verify:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6
         with:
           node-version: 20
           cache: npm
       - run: npm ci
       - run: npm run check
       - run: npm run smoke
-
diff --git a/BACKLOG.md b/BACKLOG.md
new file mode 100644
index 0000000..9f8f784
--- /dev/null
+++ b/BACKLOG.md
@@ -0,0 +1,20 @@
+# Backlog
+
+This backlog tracks public repository governance work that is safe to discuss in issues, PRs, and release planning. Do not add secrets, private logs, cookies, browser profiles, private URLs, or account-specific evidence here.
+
+## Current Governance Queue
+
+- Review Dependabot PR #6 for `@types/node` patch updates. Current required check `verify` is passing, but merging remains a maintainer action.
+- Keep issue #5 open as the public v0.1.0 feedback collection point until launch feedback has been triaged into concrete issues.
+- Keep main branch protection active with required PR review, stale review dismissal, strict status checks, and the `verify` required check.
+
+## Launch Hygiene
+
+- Before any new release, run `npm run check`, `npm run smoke`, and a secret/privacy scan over the changed files.
+- Keep README and launch materials aligned with the npm latest version and GitHub Pages documentation URL.
+- Avoid adoption, benchmark, security certification, or production-use claims unless there is current public evidence.
+
+## Later
+
+- Add a short Dependabot review checklist for patch, minor, and major dependency updates.
+- Add a release checklist that links launch copy, distribution notes, smoke output, and npm package metadata.