diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a865cae..09f8a13 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,11 @@ jobs:
     if: github.ref == 'refs/heads/main' || inputs.dry_run
     permissions:
       contents: read
-    uses: WireCatLabs/cli-core/.github/workflows/release-checks.yml@b36a30fb6037b457001bd2db860949f64512ecdd # v0.17.3
+      actions: read
+      security-events: write
+    uses: WireCatLabs/cli-core/.github/workflows/release-checks.yml@1183bfb970330989ad8acec917b14b7e6187de15
+    with:
+      languages: '["actions","javascript-typescript","python"]'
 
   build:
     needs: checks
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ce1623a..33b6054 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -8,6 +8,10 @@ Every entry says what changed as a caller sees it, why, and what to watch for 
 
 ## Unreleased
 
+### Security
+
+- Fast secret checks remain on PRs; source, production dependency and workflow security checks run before publication. Automatic Socket checks are disabled.
+
 ### Added
 
 - On-demand offline search verification for exact published Telegram and MAX packages, with
diff --git a/socket.yml b/socket.yml
new file mode 100644
index 0000000..b5c0fa2
--- /dev/null
+++ b/socket.yml
@@ -0,0 +1,3 @@
+version: 2
+githubApp:
+  enabled: false