diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..cf586fc
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @amoussa1229
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
index 9cab3a8..bf5c9df 100644
--- a/.github/PULL_REQUEST_TEMPLATE.md
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -16,3 +16,12 @@ PR conventions — see engineering-handbook/pull-requests.md
 
 ## Notes
 <!-- Anything reviewers should know: migration steps, deploy order, follow-ups, breaking changes. Delete this section if empty. -->
+
+## Sea Haven checklist
+- [ ] CDK diff / SAM changeset reviewed (if infra change)
+- [ ] Secrets added to Parameter Store / Secrets Manager (not hardcoded)
+- [ ] DynamoDB PITR verified on new tables
+- [ ] Slack notification tested in staging
+- [ ] Confluence Architecture Map updated
+- [ ] Memory update queued (if new repo/stack)
+- [ ] Cross-review requested (if IAM or Lambda handler signature change)
diff --git a/.github/workflows/callable-dependency-review.yaml b/.github/workflows/callable-dependency-review.yaml
new file mode 100644
index 0000000..646225b
--- /dev/null
+++ b/.github/workflows/callable-dependency-review.yaml
@@ -0,0 +1,14 @@
+name: Dependency Review
+on:
+  workflow_call:
+permissions:
+  contents: read
+  pull-requests: write
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index 5ed6726..8bdce3c 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: docker/setup-qemu-action@v3
         if: ${{ inputs.enable-qemu }}
@@ -90,7 +90,7 @@ jobs:
             pip install -r "$req"
           done
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-mobile-ios.yaml b/.github/workflows/cd-mobile-ios.yaml
index 40036b7..c20896f 100644
--- a/.github/workflows/cd-mobile-ios.yaml
+++ b/.github/workflows/cd-mobile-ios.yaml
@@ -60,9 +60,9 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-sam.yaml b/.github/workflows/cd-sam.yaml
index 0d8f69f..4be533d 100644
--- a/.github/workflows/cd-sam.yaml
+++ b/.github/workflows/cd-sam.yaml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-python@v5
         with:
@@ -48,7 +48,7 @@ jobs:
 
       - uses: aws-actions/setup-sam@v2
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/ci-dotnet.yaml b/.github/workflows/ci-dotnet.yaml
index 06b8b2b..8d735bd 100644
--- a/.github/workflows/ci-dotnet.yaml
+++ b/.github/workflows/ci-dotnet.yaml
@@ -31,7 +31,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-dotnet@v5
         with:
diff --git a/.github/workflows/ci-python-sam.yaml b/.github/workflows/ci-python-sam.yaml
index 4346167..dd1f5d9 100644
--- a/.github/workflows/ci-python-sam.yaml
+++ b/.github/workflows/ci-python-sam.yaml
@@ -52,7 +52,7 @@ jobs:
       group: ci-${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: actions/setup-python@v5
         with:
diff --git a/.github/workflows/ci-typescript-cdk.yaml b/.github/workflows/ci-typescript-cdk.yaml
index 1348861..f3ac699 100644
--- a/.github/workflows/ci-typescript-cdk.yaml
+++ b/.github/workflows/ci-typescript-cdk.yaml
@@ -64,7 +64,7 @@ jobs:
       group: ci-${{ github.workflow }}-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: docker/setup-qemu-action@v3
         if: ${{ inputs.enable-qemu }}
diff --git a/.github/workflows/compliance-audit.yaml b/.github/workflows/compliance-audit.yaml
index dff1e85..2d89c71 100644
--- a/.github/workflows/compliance-audit.yaml
+++ b/.github/workflows/compliance-audit.yaml
@@ -57,13 +57,13 @@ jobs:
           repositories: ${{ matrix.repo }},engineering-handbook
 
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: Sea-Haven-Industries/${{ matrix.repo }}
           token: ${{ steps.app-token.outputs.token }}
 
       - name: Checkout engineering handbook
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           repository: Sea-Haven-Industries/engineering-handbook
           token: ${{ steps.app-token.outputs.token }}