diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..27b9759
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,19 @@
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    groups:
+      actions:
+        patterns:
+          - "*"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d337c2..a36405c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,6 +12,7 @@ permissions:
 jobs:
   test:
     runs-on: self-hosted
+    timeout-minutes: 15
     container:
       image: golang:1.26.4
     steps:
@@ -23,6 +24,11 @@ jobs:
       - name: Vet
         run: go vet ./...
 
+      - name: Govulncheck
+        run: |
+          go install golang.org/x/vuln/cmd/govulncheck@latest
+          govulncheck ./...
+
       - name: Test
         run: go test -v -race -count=1 ./...
 
diff --git a/Makefile b/Makefile
index ce29079..fd1e389 100644
--- a/Makefile
+++ b/Makefile
@@ -14,13 +14,15 @@ BUILD_DATE  := $(shell date -u +"%Y-%m-%dT%H:%M:%SZ")
 
 VERSION     ?= $(if $(GIT_TAG),$(GIT_TAG),v0.0.0-$(GIT_COMMIT))
 
-LD_FLAGS    := -s -w \
+LD_FLAGS    := \
 	-X main.Version=$(VERSION) \
 	-X main.GitCommit=$(GIT_COMMIT) \
 	-X main.BuildDate=$(BUILD_DATE)
 
+RELEASE_LD_FLAGS := -s -w $(LD_FLAGS)
+
 define BUILD_PLATFORM
-	GOOS=$(1) GOARCH=$(2) CGO_ENABLED=0 $(GO) build -ldflags "$(LD_FLAGS)" \
+	GOOS=$(1) GOARCH=$(2) CGO_ENABLED=0 $(GO) build -ldflags "$(RELEASE_LD_FLAGS)" \
 		-o $(DIST_DIR)/$(BINARY_NAME)-$(1)-$(2)$(3) \
 		./cmd/opencodereview
 endef