diff --git a/.github/workflows/zola-deploy.yml b/.github/workflows/zola-deploy.yml
index 9e39ec3d..192ce0cf 100644
--- a/.github/workflows/zola-deploy.yml
+++ b/.github/workflows/zola-deploy.yml
@@ -54,7 +54,7 @@ jobs:
           repository: valkey-io/valkey-json
           path: valkey-json
 
-      - name: Init commands, topics and clients
+      - name: Init commands, topics, clients and security.txt
         run: |
           cd website
           ./build/init-topics-and-clients.sh ../valkey-doc/topics \
@@ -62,6 +62,7 @@ jobs:
           ./build/init-commands.sh ../valkey-doc/commands \
             ../valkey/src/commands ../valkey-bloom/src/commands \
             ../valkey-json/src/commands ../valkey-search/src/commands
+          ./build/init-security-txt.sh .
 
       - name: Build only
         uses: shalzz/zola-deploy-action@v0.22.0
diff --git a/.gitignore b/.gitignore
index e9aeccba..8fa6502e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -21,3 +21,4 @@ _data/modules.json
 .idea/*
 tmp/*
 static/debug
+static/.well-known/security.txt
diff --git a/build/init-security-txt.sh b/build/init-security-txt.sh
new file mode 100755
index 00000000..37989a71
--- /dev/null
+++ b/build/init-security-txt.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+# See README for usage
+# This file will generate static/.well-known/security.txt (RFC 9116).
+#
+# The Expires field is derived from the build date rather than committed, so it
+# always sits one year past the last site build and cannot silently go stale.
+
+# first check to make sure there are arguments
+if [ -z "$1" ]; then
+    echo "You must supply a path to the site root as the first argument"
+    exit 1
+fi
+
+# check for validity of this argument as a path
+if [ ! -d "$1" ]; then
+    echo "The site root must exist and be a valid path"
+    exit 1
+fi
+
+SITE_ROOT="$1"
+WELL_KNOWN="${SITE_ROOT}/static/.well-known"
+
+# one year past this build, in the RFC 3339 form RFC 9116 requires
+if date -u -d '+1 year' >/dev/null 2>&1; then
+    EXPIRES=$(date -u -d '+1 year' +%Y-%m-%dT%H:%M:%SZ)   # GNU date
+else
+    EXPIRES=$(date -u -v+1y +%Y-%m-%dT%H:%M:%SZ)          # BSD date
+fi
+
+mkdir -p "$WELL_KNOWN"
+
+cat > "${WELL_KNOWN}/security.txt" <<EOF
+# Valkey security contact — see https://github.com/valkey-io/valkey/security/policy
+# Generated at build time by build/init-security-txt.sh — do not edit by hand.
+Contact: mailto:security@lists.valkey.io
+Expires: ${EXPIRES}
+Preferred-Languages: en
+Canonical: https://valkey.io/.well-known/security.txt
+Policy: https://github.com/valkey-io/valkey/security/policy
+EOF
+
+echo "Wrote ${WELL_KNOWN}/security.txt (Expires: ${EXPIRES})"