diff --git a/CHANGELOG.md b/CHANGELOG.md
index b85d562..157da97 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,9 @@ Building toward 1.0.0 release. Using 0.x versions during active development.
 **Fixed:**
 - `PagesController` now reads the page slug from the route's `defaults: {page: ...}` (via `params[:page]`) instead of parsing `request.path`, fixing 404s for root-path pages (`bunko_page :home, path: "/"`) and pages with custom paths (`bunko_page :about, path: "about-us"`) (#57)
 
+**Security:**
+- Gemspec hardening: require MFA for RubyGems pushes (`rubygems_mfa_required`) and add `source_code_uri` and `bug_tracker_uri` metadata.
+
 ## [0.2.0] - 2025-11-14
 
 First functional release of Bunko - a lightweight Rails CMS based on the "one model, infinite collections" philosophy.
diff --git a/bunko.gemspec b/bunko.gemspec
index 7c3e06b..7cf7ada 100644
--- a/bunko.gemspec
+++ b/bunko.gemspec
@@ -15,7 +15,10 @@ Gem::Specification.new do |spec|
   spec.required_ruby_version = ">= 4.0"
 
   spec.metadata["homepage_uri"] = spec.homepage
+  spec.metadata["source_code_uri"] = spec.homepage
   spec.metadata["changelog_uri"] = "https://github.com/kanejamison/bunko/blob/main/CHANGELOG.md"
+  spec.metadata["bug_tracker_uri"] = "#{spec.homepage}/issues"
+  spec.metadata["rubygems_mfa_required"] = "true"
 
   # Specify which files should be added to the gem when it is released.
   # The `git ls-files -z` loads the files in the RubyGem that have been added into git.