diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..250f74f
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+version: 2
+updates:
+  - package-ecosystem: pre-commit
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      pre-commit:
+        patterns:
+          - "*"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+    groups:
+      actions-deps:
+        patterns:
+          - "*"
diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
new file mode 100644
index 0000000..4494aaa
--- /dev/null
+++ b/.github/workflows/autofix.yml
@@ -0,0 +1,31 @@
+# The workflow name is mandated by autofix.ci.
+# It needs to be a dedicated workflow, as autofix.ci times out on long runs.
+name: autofix.ci
+
+on:
+  pull_request:
+
+env:
+  FORCE_COLOR: "1"
+  UV_COMPILE_BYTECODE: "1"
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: Pre-commit checks
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          filter: blob:none
+          persist-credentials: false
+      - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
+        with:
+          enable-cache: true
+      - name: Run pre-commit hooks
+        run: uvx prek run --all-files --show-diff-on-failure --color=always
+      - uses: autofix-ci/action@c5b2d67aa2274e7b5a18224e8171550871fc7e4a # v1.3.4
+        if: ${{ !cancelled() }}