diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 9cab3a8..bf5c9df 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -16,3 +16,12 @@ PR conventions — see engineering-handbook/pull-requests.md
 
 ## Notes
 <!-- Anything reviewers should know: migration steps, deploy order, follow-ups, breaking changes. Delete this section if empty. -->
+
+## Sea Haven checklist
+- [ ] CDK diff / SAM changeset reviewed (if infra change)
+- [ ] Secrets added to Parameter Store / Secrets Manager (not hardcoded)
+- [ ] DynamoDB PITR verified on new tables
+- [ ] Slack notification tested in staging
+- [ ] Confluence Architecture Map updated
+- [ ] Memory update queued (if new repo/stack)
+- [ ] Cross-review requested (if IAM or Lambda handler signature change)
diff --git a/.github/workflows/callable-dependency-review.yaml b/.github/workflows/callable-dependency-review.yaml
new file mode 100644
index 0000000..646225b
--- /dev/null
+++ b/.github/workflows/callable-dependency-review.yaml
@@ -0,0 +1,14 @@
+name: Dependency Review
+on:
+  workflow_call:
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high