diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..f481221
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,2 @@
+# Security team must approve all changes to main
+* @jup-ag/security-team
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..62bb106
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,19 @@
+## Summary
+Short summary of the change and impact.
+
+## Audit Status
+- [ ] **Required** — Audit completed and artifacts attached
+- [ ] **Not Required** — *Justification below (3–5 lines)*
+
+### If Required
+- Audit report link: <!-- link to PDF/report -->
+- Scope: <!-- commit range / modules -->
+- Key findings + fixes: <!-- bullet points -->
+
+### If Not Required (Justification)
+<!-- Why this change does not require audit: e.g., comment-only, docs, non-executable, refactor with no logic change, test-only, etc. Include risk reasoning. -->
+
+## Deployment Intent
+- [ ] No deploy
+- [ ] Deploy new program
+- [ ] **Upgrade** existing program