diff --git a/.gitattributes b/.gitattributes
index 980ce67..36b2a7c 100644
--- a/.gitattributes
+++ b/.gitattributes
@@ -29,3 +29,5 @@
 
 dep5                text
 packages.lock.json  text linguist-generated
+
+CODEOWNERS  text
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..4bec9fd
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+# SPDX-FileCopyrightText: 2026 Frans van Dorsselaer
+#
+# SPDX-License-Identifier: MIT
+
+*   @dorssel
diff --git a/.github/SECURITY.md b/.github/SECURITY.md
new file mode 100644
index 0000000..74630fb
--- /dev/null
+++ b/.github/SECURITY.md
@@ -0,0 +1,20 @@
+<!--
+SPDX-FileCopyrightText: 2020 Frans van Dorsselaer
+
+SPDX-License-Identifier: MIT
+-->
+
+# Security Policy
+
+## Supported Versions
+
+Only the latest published release of the software contains the latest security fixes.
+Security fixes are not backported to older versions.
+
+Please consult the [Security Advisories](https://github.com/dorssel/dotnet-ef-sqlite-timestamp/security/advisories) for any known
+outstanding security vulnerabilities in the latest release.
+
+## Reporting a Vulnerability
+
+Please [report vulnerabilities](https://github.com/dorssel/dotnet-ef-sqlite-timestamp/security/advisories/new) privately,
+and *not* through public channels.