diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..5a32bd8
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..40cf3df
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,45 @@
+# Contributing
+
+This repo is the documentation site at
+[docs.openpreflight.xyz](https://docs.openpreflight.xyz) — Astro + Starlight. It
+is the source of truth for the docs. The tool it documents lives in
+[openpreflight/openpreflight](https://github.com/openpreflight/openpreflight);
+for the Go build and test loop, see
+[Development](https://docs.openpreflight.xyz/contributing/development/).
+
+## Dev loop
+
+```bash
+npm ci
+npm run dev             # local preview
+npm run build           # static output in dist/
+npm run check-links     # required paths + internal hrefs + external allow-list
+```
+
+`check-links` runs against `dist/`, so build first. It fails on a missing
+required asset or an external link outside the allow-list in
+`scripts/check-links.mjs` — if you add an outbound domain, add it there too.
+
+## Writing docs
+
+- Pages live under `src/content/docs/`, one directory per sidebar group. Groups
+  are autogenerated, so adding a page to an existing group needs no config
+  change — drop the markdown in the right directory and set `sidebar.order` in
+  its frontmatter. A brand-new group does need an entry in
+  `astro.config.mjs`.
+- Document what the code does today, not what is planned. If a change here
+  describes new behaviour, the matching pull request in
+  [openpreflight/openpreflight](https://github.com/openpreflight/openpreflight)
+  should land first or alongside it.
+- Architecture decisions go in `src/content/docs/adr/` as a new numbered record
+  rather than as an edit to an existing one.
+- `design.md` is the brand spec, shared with the marketing site. It is not
+  served; do not move it into `public/`.
+
+## Pull requests
+
+- One concern per PR.
+- `npm run build && npm run check-links` clean before you open it.
+- Security-sensitive reports go through
+  [openpreflight/openpreflight SECURITY.md](https://github.com/openpreflight/openpreflight/blob/main/SECURITY.md),
+  not a public issue.