diff --git a/components/privateRepo.ts b/components/privateRepo.ts
index 26a488e..d4efcfa 100644
--- a/components/privateRepo.ts
+++ b/components/privateRepo.ts
@@ -15,8 +15,11 @@ export class PrivateRepo extends Repo {
 			},
 		}, opts);
 
+		if (opts?.urn) return; // Refreshing
+
 		const repo = this.repo;
+		const vulnerabilityAlerts = this.vulnerabilityAlerts;
 
-		this.registerOutputs({ repo });
+		this.registerOutputs({ repo, vulnerabilityAlerts });
 	}
 }
diff --git a/components/publicRepo.ts b/components/publicRepo.ts
index 4e78de5..d5216b4 100644
--- a/components/publicRepo.ts
+++ b/components/publicRepo.ts
@@ -22,7 +22,7 @@ export interface PublicRepoArgs {
 }
 
 export class PublicRepo extends Repo {
-	public readonly mainRuleset: gh.RepositoryRuleset;
+	public readonly mainRuleset!: gh.RepositoryRuleset;
 
 	constructor(
 		name: string,
@@ -39,7 +39,6 @@ export class PublicRepo extends Repo {
 					visibility: 'public',
 					allowAutoMerge: true,
 					template: args.template,
-					vulnerabilityAlerts: true,
 					pages: args.pages,
 					topics: args.topics,
 				},
@@ -47,7 +46,10 @@ export class PublicRepo extends Repo {
 			opts,
 		);
 
+		if (opts?.urn) return; // Refreshing
+
 		const repo = this.repo;
+		const vulnerabilityAlerts = this.vulnerabilityAlerts;
 		const statusChecks = args.githubChecks
 			? getGitHubStatusChecks(args.githubChecks)
 			: getRequiredStatusChecks(args.requiredChecks);
@@ -85,6 +87,7 @@ export class PublicRepo extends Repo {
 		this.registerOutputs({
 			repo,
 			mainRuleset,
+			vulnerabilityAlerts,
 		});
 	}
 }
diff --git a/components/repo.ts b/components/repo.ts
index 4bfa505..fc27002 100644
--- a/components/repo.ts
+++ b/components/repo.ts
@@ -7,6 +7,7 @@ export interface RepoArgs {
 
 export abstract class Repo extends ComponentResource {
 	public readonly repo!: gh.Repository;
+	public readonly vulnerabilityAlerts!: gh.RepositoryVulnerabilityAlerts;
 
 	constructor(type: string, name: string, args: RepoArgs, opts?: ComponentResourceOptions) {
 		super(type, name, args, opts);
@@ -29,6 +30,11 @@ export abstract class Repo extends ComponentResource {
 			...args.overrides,
 		}, { parent: this });
 
+		const vulnerabilityAlerts = new gh.RepositoryVulnerabilityAlerts(name, {
+			repository: repo.name,
+		}, { parent: this });
+
 		this.repo = repo;
+		this.vulnerabilityAlerts = vulnerabilityAlerts;
 	}
 }