diff --git a/.devcontainer/devcontainer-lock.json b/.devcontainer/devcontainer-lock.json
new file mode 100644
index 0000000..b6f196a
--- /dev/null
+++ b/.devcontainer/devcontainer-lock.json
@@ -0,0 +1,9 @@
+{
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "version": "2.5.9",
+      "resolved": "ghcr.io/devcontainers/features/common-utils@sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a",
+      "integrity": "sha256:cb0c4d3c276f157eed17935747e364178d75fee17f55c4e129966f64633deb3a"
+    }
+  }
+}
diff --git a/.devcontainer/devcontainer.json b/.devcontainer/devcontainer.json
index b12f051..e99b2f1 100644
--- a/.devcontainer/devcontainer.json
+++ b/.devcontainer/devcontainer.json
@@ -5,6 +5,12 @@
   // develop it here and rust-analyzer/cargo target x86_64-unknown-linux-gnu.
   "image": "mcr.microsoft.com/devcontainers/rust:1-bookworm",
 
+  "features": {
+    "ghcr.io/devcontainers/features/common-utils:2": {
+      "configureZshAsDefaultShell": true
+    }
+  },
+
   // Pre-fetch crate deps so the first rust-analyzer/cargo run is fast.
   "postCreateCommand": "cargo fetch",
 
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..7699c02
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,18 @@
+# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
+# Last matching pattern wins. Only ONE listed owner needs to approve, not all.
+
+# Default owner for everything.
+* @D3strukt0r
+
+# Files Dependabot manages — @Team-MaRo/CI (incl. the bot user) can also review,
+# so the bot's auto-approval satisfies the code-owner requirement on these paths.
+# cargo
+/Cargo.toml @D3strukt0r @Team-MaRo/CI
+/Cargo.lock @D3strukt0r @Team-MaRo/CI
+# github-actions
+/.github/workflows/ @D3strukt0r @Team-MaRo/CI
+# nix
+/flake.nix @D3strukt0r @Team-MaRo/CI
+/flake.lock @D3strukt0r @Team-MaRo/CI
+# devcontainers
+/.devcontainer/ @D3strukt0r @Team-MaRo/CI
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 31bf874..04d131e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -14,7 +14,7 @@ updates:
       - "dependabot :robot:"
     schedule:
       interval: weekly
-      day: monday # required: weekly does NOT default to Monday (GitHub keeps a random slot — here Saturday). Do not remove.
+      day: monday
       time: '09:30'
       timezone: Europe/Zurich
     groups:
@@ -22,7 +22,7 @@ updates:
         patterns:
           - "*"
 
-  - package-ecosystem: cargo
+  - package-ecosystem: devcontainers
     directory: /
     target-branch: develop
     labels:
@@ -33,10 +33,9 @@ updates:
       time: '09:30'
       timezone: Europe/Zurich
     groups:
-      cargo-minor-patch:
-        update-types:
-          - minor
-          - patch
+      devcontainers:
+        patterns:
+          - "*"
 
   - package-ecosystem: nix
     directory: /
@@ -54,3 +53,19 @@ updates:
       flake:
         patterns:
           - "*"
+
+  - package-ecosystem: cargo
+    directory: /
+    target-branch: develop
+    labels:
+      - "dependabot :robot:"
+    schedule:
+      interval: weekly
+      day: monday
+      time: '09:30'
+      timezone: Europe/Zurich
+    groups:
+      cargo-non-breaking:
+        update-types:
+          - minor
+          - patch
diff --git a/release-please-config.json b/.github/release-please-config.json
similarity index 100%
rename from release-please-config.json
rename to .github/release-please-config.json
diff --git a/.release-please-manifest.json b/.github/release-please-manifest.json
similarity index 100%
rename from .release-please-manifest.json
rename to .github/release-please-manifest.json
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 2585ff2..417a67b 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -29,7 +29,7 @@ jobs:
         if: steps.metadata.outputs.update-type == 'version-update:semver-minor' || steps.metadata.outputs.update-type == 'version-update:semver-patch'
         env:
           PR_URL: ${{ github.event.pull_request.html_url }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GITHUB_TOKEN: ${{ secrets.GH_PAT }}
         run: |
           gh pr checkout "$PR_URL" # sets the upstream metadata for `gh pr status`
           if [ "$(gh pr status --json reviewDecision -q .currentBranch.reviewDecision)" != "APPROVED" ]; then
diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml
index 1ffdfa8..666b188 100644
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -16,6 +16,7 @@ jobs:
   greeting:
     name: Greet First-Time Contributors
     runs-on: ubuntu-latest
+    if: github.actor != 'dependabot[bot]'
 
     steps:
       - name: Greet First-Time Contributors
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 925e8a2..70faf28 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,8 +7,6 @@ name: Release
 # on merge cuts a GitHub Release + git tag. The tag push fires build.yml (which
 # triggers on `tags: ['*.*.*']`) to build the per-arch binaries and attach them
 # to the release.
-#
-# Config: release-please-config.json + .release-please-manifest.json.
 
 on:
   push:
@@ -31,6 +29,8 @@ jobs:
         id: release
         uses: googleapis/release-please-action@v5
         with:
+          config-file: .github/release-please-config.json
+          manifest-file: .github/release-please-manifest.json
           # PAT instead of GITHUB_TOKEN: GitHub suppresses workflow triggers for
           # tags created via GITHUB_TOKEN, which would prevent build.yml from
           # firing on the release tag to attach the binaries.
diff --git a/AGENTS.md b/AGENTS.md
index e3c3342..f98e7e6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -96,7 +96,7 @@ releases attach:
 ## Releases
 
 Conventional commits → release-please (`release-type: rust`, configured in
-`release-please-config.json` + `.release-please-manifest.json`) opens a release PR
+`.github/release-please-config.json` + `.github/release-please-manifest.json`) opens a release PR
 bumping `Cargo.toml`/`Cargo.lock` and `flake.nix` (the `x-release-please-version`
 marker). Merging cuts a tag + GitHub Release; the tag fires `build.yml` to attach
 the binaries. Needs the `GH_PAT` secret and "Allow Actions to create PRs".
diff --git a/CODEOWNERS b/CODEOWNERS
deleted file mode 100644
index 240fb51..0000000
--- a/CODEOWNERS
+++ /dev/null
@@ -1,4 +0,0 @@
-# https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/about-code-owners
-
-# These owners will be the default owners for everything in the repo.
-* @D3strukt0r
diff --git a/flake.lock b/flake.lock
index aa10abf..4834937 100644
--- a/flake.lock
+++ b/flake.lock
@@ -2,11 +2,11 @@
   "nodes": {
     "nixpkgs": {
       "locked": {
-        "lastModified": 1781216227,
-        "narHash": "sha256-9mUW6gNwoN2SWc/l0fW4svPNOulXLl8ijqKyeSOGgJE=",
+        "lastModified": 1781808408,
+        "narHash": "sha256-0sOb6OIaD/K1zHxBhpmlKvkADfe0n8+l4Jj2e1Q0r3w=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "a0374025a863d007d98e3297f6aa46cc3141c2f0",
+        "rev": "e8210c649915deed7080033cdbabcc19e40bb899",
         "type": "github"
       },
       "original": {