diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..9d60f18
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,20 @@
+version: 2
+
+# 依存の更新は月に一度でよい。数は 20 ほどで、週ごとに出すと
+# 更新の PR を読むほうが仕事になる。Cargo は 1 本にまとめ、
+# Actions は別に出す。
+updates:
+  - package-ecosystem: cargo
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
+    groups:
+      cargo:
+        patterns: ["*"]
+
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: monthly
+    open-pull-requests-limit: 3
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e4cab91..30e7021 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
     # building on another platform yet.
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
 
       - name: Install Rust
         uses: dtolnay/rust-toolchain@stable
@@ -25,7 +25,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry
@@ -52,3 +52,30 @@ jobs:
         run: |
           ./target/release/termit --shell-integration | head -3
           ./target/release/termit --latency-test
+
+  audit:
+    # Security advisories against the lockfile. This one runs on Linux:
+    # it only reads Cargo.lock, nothing here is macOS-specific, and the
+    # Linux runner is the cheaper of the two.
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Audit the dependencies
+        uses: rustsec/audit-check@v2.0.0
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          # Neither of these has a fix this repository can reach, so
+          # they are named here rather than left to fail every run.
+          #
+          # RUSTSEC-2026-0253 (lru, unsound): fixed in 0.18.2, but
+          # glyphon pins lru to 0.16. The advisory needs a key whose
+          # Drop panics; glyphon's key is a Copy enum, which cannot
+          # implement Drop, so the path does not exist here.
+          #
+          # RUSTSEC-2026-0192 (ttf-parser, unmaintained): arrives
+          # through cosmic-text and fontdb, and has no patched release
+          # at all.
+          #
+          # Drop an entry when the crate above it moves.
+          ignore: RUSTSEC-2026-0253,RUSTSEC-2026-0192
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6ad0c2c..1618ffe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
     # Apple silicon の runner。termit は arm64 でしか測っていない。
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.inputs.tag || github.ref }}
 
@@ -29,7 +29,7 @@ jobs:
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache cargo
-        uses: actions/cache@v4
+        uses: actions/cache@v6
         with:
           path: |
             ~/.cargo/registry