diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..b639939
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,39 @@
+<!--
+Thank you for contributing to kzstd!
+Fill out the sections below. Delete any that don't apply.
+-->
+
+## Summary
+
+<!-- One or two sentences: what does this PR do? -->
+
+## Type of change
+
+- [ ] Bug fix (non-breaking)
+- [ ] New feature (non-breaking)
+- [ ] Breaking change (will require a SemVer-MINOR pre-1.0 / SemVer-MAJOR post-1.0 bump)
+- [ ] Documentation only
+- [ ] Infrastructure / CI / build
+
+## Related issue / discussion
+
+<!-- Link the issue: Fixes #123 / Refs #456. For non-trivial changes, link the design discussion. -->
+
+## Affirmations
+
+- [ ] All commits are signed off (DCO — `git commit -s`).
+- [ ] I have read [`CONTRIBUTING.md`](../CONTRIBUTING.md).
+- [ ] If this changes the public API, I have run `./gradlew apiDump` and committed the regenerated `api/*.api` files.
+- [ ] If this changes codec behavior or the wire frame, I have verified round-trip and libzstd interop (`./gradlew jvmTest`).
+- [ ] I have run `./gradlew build` locally and it passes.
+
+## How was this verified?
+
+<!--
+Describe testing — unit tests, the zstd-jni interop oracle, cross-target runs.
+For codec changes, note any before/after ratio or interop checks.
+-->
+
+## Notes for reviewers
+
+<!-- Anything else the reviewer should know. Tricky areas, open questions, follow-ups. -->
diff --git a/.github/renovate.json b/.github/renovate.json
index 118eafa..71e1417 100644
--- a/.github/renovate.json
+++ b/.github/renovate.json
@@ -8,6 +8,9 @@
   ],
   "commitMessageTopic": "{{depName}}",
   "labels": ["dependencies"],
+  "vulnerabilityAlerts": {
+    "enabled": true
+  },
   "packageRules": [
     {
       "description": "Automerge non-major dependency updates",
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index 5f4e9e2..3669773 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,10 +1,10 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.5.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.6.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
-distributionSha256Sum=bafc141b619ad6350fd975fc903156dd5c151998cc8b058e8c1044ab5f7b031f
+distributionSha256Sum=9c0f7faeeb306cb14e4279a3e084ca6b596894089a0638e68a07c945a32c9e14