diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..47ed0d7
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,20 @@
+# SPDX-FileCopyrightText: 2026 David Rabkin
+# SPDX-License-Identifier: 0BSD
+---
+name: dependency-review
+'on':
+  pull_request:
+permissions:
+  contents: read
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+jobs:
+  dependency-review:
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@v7.0.0
+        with:
+          persist-credentials: false
+      - uses: actions/dependency-review-action@v5.0.0
diff --git a/.github/workflows/rake.yml b/.github/workflows/rake.yml
index bb82125..167ad43 100644
--- a/.github/workflows/rake.yml
+++ b/.github/workflows/rake.yml
@@ -38,9 +38,14 @@ jobs:
           - 3.2
           - 3.3
           - 3.4
+        include:
+          - os: ubuntu-24.04
+            ruby: head
+            bundler: default
     name: Rake on ${{ matrix.os }} / Ruby ${{ matrix.ruby }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 15
+    continue-on-error: ${{ matrix.ruby == 'head' }}
     steps:
       - uses: actions/checkout@v7.0.0
         with:
@@ -48,5 +53,6 @@ jobs:
       - uses: ruby/setup-ruby@v1.318.0
         with:
           ruby-version: ${{ matrix.ruby }}
+          bundler: ${{ matrix.bundler || 'Gemfile.lock' }}
           bundler-cache: true
       - run: bundle exec rake