diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
new file mode 100644
index 0000000..cb8833c
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -0,0 +1,67 @@
+name: Bug report
+description: Something in wolfSPDM behaves wrongly
+labels: ["bug"]
+body:
+  - type: textarea
+    id: summary
+    attributes:
+      label: Summary
+      description: What goes wrong, in one or two sentences.
+    validations:
+      required: true
+  - type: input
+    id: commit
+    attributes:
+      label: Commit or release
+      placeholder: "e.g. 5b10254f or v1.0.0"
+    validations:
+      required: true
+  - type: dropdown
+    id: target
+    attributes:
+      label: Target
+      multiple: true
+      options:
+        - Nuvoton NPCT75x (silicon)
+        - Nations NS350 (silicon)
+        - fwTPM responder
+        - DMTF spdm-emu
+        - wolfTPM integration
+        - Host build / unit tests
+        - Other
+    validations:
+      required: true
+  - type: input
+    id: target_other
+    attributes:
+      label: Other target details
+      description: Board, TPM part, or environment if you picked Other.
+  - type: dropdown
+    id: mode
+    attributes:
+      label: SPDM mode
+      options:
+        - Standard (certificates)
+        - TCG identity key
+        - TCG PSK
+        - Not applicable
+  - type: textarea
+    id: steps
+    attributes:
+      label: Steps to reproduce
+      description: Configure flags, SPDM version, and what you ran.
+      render: shell
+    validations:
+      required: true
+  - type: textarea
+    id: expected
+    attributes:
+      label: Expected and actual behavior
+    validations:
+      required: true
+  - type: textarea
+    id: logs
+    attributes:
+      label: Logs
+      description: Console output, with --enable-debug if possible.
+      render: text
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
new file mode 100644
index 0000000..abf735a
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/config.yml
@@ -0,0 +1,5 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Report a security vulnerability
+    url: https://github.com/wolfSSL/wolfSPDM/security/advisories/new
+    about: Report vulnerabilities privately, not in a public issue.
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
new file mode 100644
index 0000000..745b1f6
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -0,0 +1,37 @@
+name: Feature request
+description: Propose new functionality for wolfSPDM
+labels: ["enhancement"]
+body:
+  - type: textarea
+    id: problem
+    attributes:
+      label: Problem
+      description: What is missing or what need does this address?
+    validations:
+      required: true
+  - type: textarea
+    id: proposal
+    attributes:
+      label: Proposal
+      description: What should wolfSPDM do?
+    validations:
+      required: true
+  - type: textarea
+    id: spec
+    attributes:
+      label: Specification references
+      description: Clauses from DSP0274, DSP0277, DSP0275, the TCG SPDM binding, or other specs that apply.
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+      description: How we will know it is done (unit tests, spdm-emu runs, hardware runs).
+    validations:
+      required: true
+  - type: input
+    id: scope
+    attributes:
+      label: Area
+      placeholder: "e.g. requester, responder, TCG binding, PQC, wolfTPM integration, CI"
+    validations:
+      required: true
diff --git a/.github/ISSUE_TEMPLATE/todo.yml b/.github/ISSUE_TEMPLATE/todo.yml
new file mode 100644
index 0000000..fc51eba
--- /dev/null
+++ b/.github/ISSUE_TEMPLATE/todo.yml
@@ -0,0 +1,36 @@
+name: Tracked follow-up
+description: Work deferred from a PR, review, or scan that must be done later
+labels: ["todo"]
+body:
+  - type: textarea
+    id: context
+    attributes:
+      label: Context
+      description: Where this came from and why it was deferred.
+    validations:
+      required: true
+  - type: input
+    id: origin
+    attributes:
+      label: Origin
+      placeholder: "PR, issue, doc section, or scan report"
+    validations:
+      required: true
+  - type: textarea
+    id: needed
+    attributes:
+      label: What is needed
+      description: The concrete work, as a short list.
+    validations:
+      required: true
+  - type: textarea
+    id: blockers
+    attributes:
+      label: Blockers and dependencies
+      description: Hardware, other PRs, or decisions this waits on.
+  - type: textarea
+    id: acceptance
+    attributes:
+      label: Acceptance criteria
+    validations:
+      required: true