diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..2f3f84c
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,17 @@
+# Canonical CODEOWNERS for Maui team repositories.
+#
+# This is the source of truth. Consuming repos do NOT edit their own
+# .github/CODEOWNERS by hand — the `sync-codeowners` reusable workflow copies
+# this file into <repo>/.github/CODEOWNERS and opens a PR when it drifts.
+#
+# GitHub only reads CODEOWNERS from a repo's root, .github/, or docs/ on the
+# default branch, so the file must physically exist in each repo; it cannot be
+# read from the .maui submodule directly.
+#
+# See https://docs.github.com/articles/about-code-owners
+
+# CI workflows, deployment config, and the CODEOWNERS file itself.
+/.github/ @beyondessential/maui
+
+# Any Python file, anywhere in the repo.
+*.py @beyondessential/maui
diff --git a/.github/workflows/sync-codeowners.yml b/.github/workflows/sync-codeowners.yml
new file mode 100644
index 0000000..cf73965
--- /dev/null
+++ b/.github/workflows/sync-codeowners.yml
@@ -0,0 +1,16 @@
+name: Sync CODEOWNERS
+
+# Keeps .github/CODEOWNERS in sync with the canonical templates/CODEOWNERS in
+# the maui-team repo. See beyondessential/maui-team .github/workflows/README.md.
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # weekly, Monday 06:00 UTC
+  workflow_dispatch:
+
+jobs:
+  sync:
+    uses: beyondessential/maui-team/.github/workflows/sync-codeowners.yml@main
+    permissions:
+      contents: write
+      pull-requests: write
diff --git a/.maui b/.maui
index 8bdb50d..cc6c7b4 160000
--- a/.maui
+++ b/.maui
@@ -1 +1 @@
-Subproject commit 8bdb50dc87b59832db997fab29fb678f25340b2c
+Subproject commit cc6c7b4594f897fb5d9e9e717d997257c68e0f42