diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..f1f10ee
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,3 @@
+# Default reviewer on every PR. Update to the GitHub handle(s) or team(s)
+# that should be auto-requested on fork PRs.
+*       @CoreNovus/maintainers
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..072b2cd
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,25 @@
+version: 2
+updates:
+  - package-ecosystem: "pip"
+    directory: "/packages/mcp-forge-core"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "pip"
+    directory: "/packages/mcp-forge-aws"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "pip"
+    directory: "/packages/mcp-forge-cli"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 738eecb..5654fc8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -4,20 +4,30 @@ on:
   push:
     branches: [main]
   pull_request:
-    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.head_ref || github.ref }}
+  cancel-in-progress: true
 
 jobs:
   test:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         python-version: ["3.11", "3.12"]
         package: [mcp-forge-core, mcp-forge-aws, mcp-forge-cli]
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: ${{ matrix.python-version }}
+          cache: pip
 
       - name: Install package
         run: |
@@ -33,8 +43,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
+        with:
+          persist-credentials: false
       - uses: actions/setup-python@v5
         with:
           python-version: "3.12"
+          cache: pip
       - run: pip install ruff
       - run: ruff check packages/
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index f19fa43..d5e7757 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -8,6 +8,7 @@ We'd love your help making mcp-forge better. Whether it's a bug fix, new provide
 # 1. Fork this repo on GitHub, then:
 git clone git@github.com:<your-username>/mcp-forge.git
 cd mcp-forge
+git remote add upstream https://github.com/CoreNovus/mcp-forge.git
 
 # 2. Install everything
 pip install -e packages/mcp-forge-core[dev]
@@ -21,8 +22,20 @@ pytest packages/mcp-forge-aws/tests/
 pytest packages/mcp-forge-cli/tests/
 ```
 
+Keep your fork in sync before starting work:
+
+```bash
+git fetch upstream
+git checkout main
+git merge --ff-only upstream/main
+```
+
 That's it. You're ready to contribute.
 
+> **First-time contributors:** a maintainer has to click **Approve and run**
+> on your first PR before CI kicks off. This is GitHub's default safety
+> behaviour for fork PRs — not a slight.
+
 ## How to Contribute
 
 ### 1. Pick something to work on