diff --git a/.github/FUNDING.yml b/.github/FUNDING.yml
new file mode 100644
index 0000000..1fde90a
--- /dev/null
+++ b/.github/FUNDING.yml
@@ -0,0 +1,3 @@
+ko_fi: redblink
+custom:
+  - https://ko-fi.com/darkdante
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..041e7d4
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 5
+    reviewers:
+      - "yacketrj"
+    labels:
+      - "ci-cd"
+      - "security"
+    commit-message:
+      prefix: "chore(ci):"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..6f87446
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,79 @@
+name: CI
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: ci-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  validate-json:
+    name: Validate JSON
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate index.json
+        run: |
+          python3 -c "import json; json.load(open('index.json'))" || { echo "Invalid JSON"; exit 1; }
+      - name: Validate addon JSON files
+        run: |
+          find addons -name "*.json" -exec python3 -c "import json,sys; json.load(open(sys.argv[1]))" {} \; || { echo "Invalid JSON found"; exit 1; }
+
+  security:
+    name: Security
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      # gitleaks/gitleaks-action@v2 runs on the Node 20 runtime, which
+      # GitHub removes from Actions entirely on 2026-09-16 (v2 requires
+      # ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION=true just to run as of
+      # 2026-06-02). v3 is the current, supported release with no input/
+      # output/behavior changes -- see gitleaks/gitleaks-action's own
+      # README migration note.
+      - name: Run gitleaks
+        uses: gitleaks/gitleaks-action@v3
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # returntocorp/semgrep-action (and its semgrep/semgrep-action
+      # successor) are both explicitly marked deprecated by their own
+      # READMEs ("stop using this wrapper script... migrate to native
+      # Semgrep support instead"). Running the semgrep CLI directly via
+      # its official Docker image is the current recommended approach.
+      - name: Run semgrep
+        run: |
+          docker run --rm -v "${{ github.workspace }}:/src" semgrep/semgrep \
+            semgrep --config p/security-audit --error /src
+
+  ci-gate:
+    name: CI Gate
+    if: ${{ always() }}
+    needs: [validate-json, security]
+    runs-on: ubuntu-latest
+    steps:
+      - name: Require every check to pass
+        env:
+          JSON: ${{ needs.validate-json.result }}
+          SECURITY: ${{ needs.security.result }}
+        run: |
+          set -euo pipefail
+          failed=0
+          for result in "$JSON" "$SECURITY"; do
+            if [ "$result" != "success" ]; then
+              failed=1
+            fi
+          done
+          if [ "$failed" -ne 0 ]; then
+            echo "One or more required checks did not pass."
+            exit 1
+          fi
+          echo "All required checks passed."
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..bd2e48b
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,26 @@
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+  - cron: '15 8 * * *'
+name: Semgrep
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: semgrep/semgrep
+    steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - run: semgrep ci
diff --git a/addons/dune-ops-observability.json b/addons/dune-ops-observability.json
index c21b901..ceef386 100644
--- a/addons/dune-ops-observability.json
+++ b/addons/dune-ops-observability.json
@@ -2,9 +2,9 @@
   "schemaVersion": 1,
   "id": "dune-ops-observability",
   "name": "Dune Ops Observability",
-  "description": "Read-only operations addon providing NOC dashboard, player activity, spice field tracking, and OPS health monitoring through the Console bridge.",
+  "description": "Read-only operations addon providing NOC dashboard, player activity, spice field tracking, OPS health monitoring, and live Prometheus/Grafana metrics through the Console bridge.",
   "author": "DarkDante",
-  "version": "0.4.7",
+  "version": "0.5.1",
   "type": "ui",
   "entry": {
     "navigation": "Ops Observability",
@@ -16,6 +16,6 @@
     ]
   },
   "sourceUrl": "https://github.com/yacketrj/dune-ops-observability-addon",
-  "downloadUrl": "https://github.com/yacketrj/dune-ops-observability-addon/releases/download/v0.4.7/dune-ops-observability-0.4.7.zip",
-  "sha256": "e8ed5655aff2425668f7a9f7bab359bad71279b96b821d0a7c4aae24a92bb59f"
+  "downloadUrl": "https://github.com/yacketrj/dune-ops-observability-addon/releases/download/v0.5.1/dune-ops-observability-0.5.1.zip",
+  "sha256": "f3052db8d862fd5e088c19ca36a6726d77030c71cba7ccc40c33c4bce622cbb1"
 }