diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 86a8445..1281f6c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -70,6 +70,32 @@ jobs:
           queries: security-extended
       - uses: github/codeql-action/analyze@v3
 
+  semgrep:
+    name: SAST (Semgrep)
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep
+    steps:
+      - uses: actions/checkout@v4
+      - run: semgrep scan --config auto --error --severity ERROR
+
+  dependency-audit:
+    name: Dependency audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+      - name: Audit dependencies
+        run: |
+          set -euo pipefail
+          # The package declares no dependencies today, so this passes trivially. It is
+          # wired up anyway: the moment a dependency is added the audit becomes real and
+          # blocking, instead of being something someone has to remember to add.
+          npm install --package-lock-only --no-audit --no-fund
+          npm audit --audit-level=high
+
   secret-scan:
     name: Secret scan
     runs-on: ubuntu-latest