diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..7688c79
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,12 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+
+  - package-ecosystem: "npm"
+    directory: "/scripts"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..99dfd53
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,47 @@
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  contracts:
+    name: forge build + test
+    runs-on: ubuntu-22.04
+    steps:
+      - uses: actions/checkout@v5
+
+      - name: Install Foundry
+        uses: foundry-rs/foundry-toolchain@v1
+        with:
+          version: stable
+
+      - name: Install forge dependencies
+        run: |
+          # Repo references openzeppelin-contracts + forge-std but lib/ is git-ignored.
+          # Install them via forge install.
+          forge install OpenZeppelin/openzeppelin-contracts foundry-rs/forge-std
+
+      - name: forge build
+        run: forge build --sizes
+
+      - name: forge test
+        run: forge test -vv
+
+      - name: Setup Node 20 (for sentrix RPC scripts)
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: viem typecheck (script/)
+        run: |
+          if [ -f scripts/package.json ]; then
+            cd scripts && npm ci && npx tsc --noEmit
+          else
+            echo "no scripts/ npm package — skipping"
+          fi
diff --git a/.github/workflows/owner-auto-merge.yml b/.github/workflows/owner-auto-merge.yml
new file mode 100644
index 0000000..fe274ba
--- /dev/null
+++ b/.github/workflows/owner-auto-merge.yml
@@ -0,0 +1,27 @@
+name: Owner auto-merge
+
+on:
+  pull_request_target:
+    types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+  pull-requests: write
+  contents: write
+
+jobs:
+  enable-auto-merge:
+    runs-on: ubuntu-22.04
+    if: >
+      github.event.pull_request.user.login == 'satyakwok' &&
+      github.event.pull_request.draft == false
+    steps:
+      - name: Enable auto-merge (squash) for owner PR
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_URL: ${{ github.event.pull_request.html_url }}
+        run: |
+          set -e
+          gh pr merge --auto --squash "$PR_URL" || {
+            echo "::warning::auto-merge enable returned non-zero — PR may already be merged, conflicted, or have auto-merge already enabled."
+            exit 0
+          }