diff --git a/.copier-answers.safe-settings.yml b/.copier-answers.safe-settings.yml
new file mode 100644
index 0000000..437a335
--- /dev/null
+++ b/.copier-answers.safe-settings.yml
@@ -0,0 +1,3 @@
+# Changes here will be overwritten by Copier; NEVER EDIT MANUALLY
+_commit: v2.1.0
+_src_path: https://github.com/dafyddj/copier-safe-settings
diff --git a/.github/workflows/libsafe-settings.yml b/.github/workflows/libsafe-settings.yml
new file mode 100644
index 0000000..c2a7a63
--- /dev/null
+++ b/.github/workflows/libsafe-settings.yml
@@ -0,0 +1,69 @@
+name: Apply Safe Settings
+on:
+  workflow_call:
+    inputs:
+      admin-repo:
+        type: string
+        default: .github
+      config-path:
+        type: string
+        default: safe-settings
+      deployment-config-file:
+        type: string
+        default: deployment-settings.yml
+      dry-run:
+        type: boolean
+        default: true
+      skip-dry-run-errors:
+        type: boolean
+        default: true
+      target-environment:
+        type: string
+        default: production
+
+permissions: {}
+
+jobs:
+  apply-safe-settings:
+    permissions:
+      contents: read
+    runs-on: ubuntu-24.04
+    environment: ${{ github.ref_name == github.event.repository.default_branch && inputs.target-environment || 'test' }}
+    env:
+      # Version/tag of `github/safe-settings` repository to use:
+      SAFE_SETTINGS_VERSION: ff7a65655d33006b9820479df0a9e1057a8927e4 # 2.1.17
+
+      # Path on GHA runner box where safe-settings code downloaded to:
+      SAFE_SETTINGS_CODE_DIR: .safe-settings-code
+    steps:
+      # Self-checkout to access deployment configuration
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      # Checkout of `safe-settings` source repository to run app
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: github/safe-settings
+          ref: ${{ env.SAFE_SETTINGS_VERSION }}
+          path: ${{ env.SAFE_SETTINGS_CODE_DIR }}
+          persist-credentials: false
+      - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
+        with:
+          cache: npm
+          cache-dependency-path: ${{ env.SAFE_SETTINGS_CODE_DIR }}/package-lock.json
+          node-version-file: ${{ env.SAFE_SETTINGS_CODE_DIR }}/.nvmrc
+      - run: npm install
+        working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
+      - name: Run Safe-Settings Full-Sync
+        continue-on-error: ${{ inputs.dry-run && inputs.skip-dry-run-errors }}
+        run: |
+          npm run full-sync
+        working-directory: ${{ env.SAFE_SETTINGS_CODE_DIR }}
+        env:
+          APP_ID: ${{ vars.SAFE_SETTINGS_APP_ID }}
+          ADMIN_REPO: ${{ inputs.admin-repo }}
+          CONFIG_PATH: ${{ inputs.config-path }}
+          DEPLOYMENT_CONFIG_FILE: ${{ github.workspace }}/${{ inputs.config-path }}/${{ inputs.deployment-config-file }}
+          FULL_SYNC_NOP: ${{ inputs.dry-run }}
+          LOG_LEVEL: ${{ vars.SAFE_SETTINGS_LOG_LEVEL || 'debug' }}
+          PRIVATE_KEY: ${{ secrets.SAFE_SETTINGS_PRIVATE_KEY }}