diff --git a/.github/renovate.json b/.github/renovate.json
new file mode 100644
index 0000000..0033935
--- /dev/null
+++ b/.github/renovate.json
@@ -0,0 +1,60 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ],
+  "schedule": ["before 6am on Monday"],
+  "timezone": "UTC",
+  "pinDigests": true,
+  "labels": ["dependencies"],
+  "packageRules": [
+    {
+      "description": "Group Overlord-Server minor and patch npm updates",
+      "matchManagers": ["npm"],
+      "matchPaths": ["Overlord-Server/package.json"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "Overlord-Server dependencies (minor + patch)",
+      "automerge": false
+    },
+    {
+      "description": "Group Overlord-Desktop minor and patch npm updates",
+      "matchManagers": ["npm"],
+      "matchPaths": ["Overlord-Desktop/package.json"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "Overlord-Desktop dependencies (minor + patch)",
+      "automerge": false
+    },
+    {
+      "description": "Group Go module minor and patch updates",
+      "matchManagers": ["gomod"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "Go modules (minor + patch)",
+      "automerge": false
+    },
+    {
+      "description": "Group GitHub Actions minor and patch updates",
+      "matchManagers": ["github-actions"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "GitHub Actions (minor + patch)",
+      "automerge": false
+    },
+    {
+      "description": "Group Docker base image minor and patch updates",
+      "matchManagers": ["dockerfile", "docker-compose"],
+      "matchUpdateTypes": ["minor", "patch"],
+      "groupName": "Docker base images (minor + patch)",
+      "automerge": false
+    },
+    {
+      "description": "Individual PRs for all major updates",
+      "matchUpdateTypes": ["major"],
+      "groupName": null,
+      "automerge": false
+    }
+  ],
+  "ignoreDeps": [],
+  "vulnerabilityAlerts": {
+    "enabled": true,
+    "labels": ["dependencies", "security"]
+  }
+}
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 76c30c1..8cba667 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -130,3 +130,39 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           platforms: linux/amd64,linux/arm64
+
+  trivy-scan:
+    needs: build-and-push
+    runs-on: ubuntu-latest
+    permissions:
+      packages: read
+      security-events: write
+
+    steps:
+      - name: Normalize image name
+        run: echo "IMAGE_NAME=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
+
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v3
+        with:
+          registry: ${{ env.REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@0.28.0
+        with:
+          image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH
+          exit-code: '1'
+          ignore-unfixed: true
+          vuln-type: os,library
+
+      - name: Upload Trivy scan results to GitHub Security
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: trivy-results.sarif
+          category: trivy