diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000000..f6a603ae53c
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,27 @@
+version: 2
+updates:
+  - package-ecosystem: "bun"
+    directory: "/"
+    target-branch: "AgentHits-Dev"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    cooldown:
+      default-days: 3
+    open-pull-requests-limit: 5
+    groups:
+      minor-and-patch:
+        update-types: ["minor", "patch"]
+    ignore:
+      # Major bumps are done by hand, one PR each, after a check on dev.
+      - dependency-name: "*"
+        update-types: ["version-update:semver-major"]
+      # Held back on purpose: these break typecheck, change API behavior or need migrations.
+      - dependency-name: "better-auth"
+        update-types: ["version-update:semver-minor"]
+      - dependency-name: "@better-auth/*"
+        update-types: ["version-update:semver-minor"]
+      - dependency-name: "stripe"
+      - dependency-name: "@stepperize/react"
+      - dependency-name: "@dokploy/trpc-openapi"
+      - dependency-name: "ssh2"
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index c4fca46456f..2a514b4046f 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -2,15 +2,28 @@ name: Pull Request
 
 on:
   pull_request:
-    branches: [main, canary]
+    branches: [main, canary, AgentHits-Dev]
 
 permissions:
   contents: read
 
 jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: oven-sh/setup-bun@v2
+        with:
+          bun-version: 1.4.2
+      # GHSA-vfj7-8cjw-p6xm: braces 3.0.3 (via micromatch) has no patched release yet.
+      - run: bun audit --audit-level=moderate --ignore GHSA-vfj7-8cjw-p6xm
+
   pr-check:
     runs-on: ubuntu-latest
     strategy:
+      fail-fast: false
       matrix:
         job: [build, test, typecheck]
     steps:
@@ -52,3 +65,6 @@ jobs:
       - run: bun install --frozen-lockfile
       - run: bun run server:build
       - run: bun run ${{ matrix.job }}
+        env:
+          # The fork's db module throws without a password in production, and the Next build imports it.
+          POSTGRES_PASSWORD: ${{ matrix.job == 'build' && 'build-time-postgres-password' || '' }}
diff --git a/bunfig.toml b/bunfig.toml
new file mode 100644
index 00000000000..b5d11bc61ef
--- /dev/null
+++ b/bunfig.toml
@@ -0,0 +1,3 @@
+[install]
+# Freshly published versions are where hijacked releases live; most get pulled within days.
+minimumReleaseAge = 259200