diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..521c192
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,28 @@
+name: Dependency Review
+
+on:
+  pull_request:
+  merge_group:
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    name: Dependency Review
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Review dependency changes
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+        with:
+          base-ref: ${{ github.event.merge_group.base_sha }}
+          head-ref: ${{ github.event.merge_group.head_sha }}
+          fail-on-severity: high
+          license-check: false
+          retry-on-snapshot-warnings: true
+          show-patched-versions: true
diff --git a/README.md b/README.md
index 0d6839e..0b44bdb 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,15 @@
-# .github
-Organization-wide GitHub configuration and required workflows
+# acg-box GitHub configuration
+
+This repository contains centrally managed GitHub configuration for the
+`acg-box` organization.
+
+## Required workflows
+
+The enterprise `dependency-review` ruleset runs
+`.github/workflows/dependency-review.yml` for pull requests and merge queues in
+every targeted repository. It blocks changes that introduce dependencies with
+known high or critical vulnerabilities. Lower-severity findings remain visible
+in the workflow report without blocking the merge.
+
+The workflow is maintained only in this repository; individual repositories do
+not need caller workflows.