diff --git a/.claude/settings.local.json b/.claude/settings.local.json
new file mode 100644
index 0000000..9c025c0
--- /dev/null
+++ b/.claude/settings.local.json
@@ -0,0 +1,6 @@
+{
+  "enabledMcpjsonServers": [
+    "github-repo-rag"
+  ],
+  "enableAllProjectMcpServers": true
+}
diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..2f3f84c
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,17 @@
+# Canonical CODEOWNERS for Maui team repositories.
+#
+# This is the source of truth. Consuming repos do NOT edit their own
+# .github/CODEOWNERS by hand — the `sync-codeowners` reusable workflow copies
+# this file into <repo>/.github/CODEOWNERS and opens a PR when it drifts.
+#
+# GitHub only reads CODEOWNERS from a repo's root, .github/, or docs/ on the
+# default branch, so the file must physically exist in each repo; it cannot be
+# read from the .maui submodule directly.
+#
+# See https://docs.github.com/articles/about-code-owners
+
+# CI workflows, deployment config, and the CODEOWNERS file itself.
+/.github/ @beyondessential/maui
+
+# Any Python file, anywhere in the repo.
+*.py @beyondessential/maui
diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
deleted file mode 100644
index 25ceb50..0000000
--- a/.github/workflows/claude-code-review.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-name: Claude Code Review
-
-on:
-  pull_request:
-    types: [opened, reopened, synchronize]
-  issue_comment:
-    types: [created]
-
-jobs:
-  claude-review:
-    if: >-
-      github.event_name == 'pull_request' ||
-        (github.event_name == 'issue_comment' &&
-        github.event.issue.pull_request != null &&
-        contains(github.event.comment.body, '/review'))
-    uses: beyondessential/maui-team/.github/workflows/claude-code-review.yml@main
-    secrets: inherit
diff --git a/.github/workflows/sync-codeowners.yml b/.github/workflows/sync-codeowners.yml
new file mode 100644
index 0000000..cf73965
--- /dev/null
+++ b/.github/workflows/sync-codeowners.yml
@@ -0,0 +1,16 @@
+name: Sync CODEOWNERS
+
+# Keeps .github/CODEOWNERS in sync with the canonical templates/CODEOWNERS in
+# the maui-team repo. See beyondessential/maui-team .github/workflows/README.md.
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # weekly, Monday 06:00 UTC
+  workflow_dispatch:
+
+jobs:
+  sync:
+    uses: beyondessential/maui-team/.github/workflows/sync-codeowners.yml@main
+    permissions:
+      contents: write
+      pull-requests: write
diff --git a/.maui b/.maui
index 8bdb50d..28cd619 160000
--- a/.maui
+++ b/.maui
@@ -1 +1 @@
-Subproject commit 8bdb50dc87b59832db997fab29fb678f25340b2c
+Subproject commit 28cd619157c216347ad4755dbeb6d0e8e09f5686
diff --git a/README.md b/README.md
index b7f921f..6a995da 100644
--- a/README.md
+++ b/README.md
@@ -252,12 +252,6 @@ CHANGED_FILES="src/foo.ts src/bar.ts" DELETED_FILES="src/old.ts" \
 
 The GitHub Actions workflow (`.github/workflows/reindex.yml`) runs a full reindex every Monday and can be triggered manually via `workflow_dispatch`.
 
-## Code review
-
-Pull requests are automatically reviewed by Claude via `.github/workflows/claude-code-review.yml`, which delegates to the shared [`maui-team`](https://github.com/beyondessential/maui-team) workflow. Re-trigger a review by commenting `/review` on any PR.
-
-Requires `ANTHROPIC_API_KEY` set as a repository secret.
-
 ## File structure
 
 ```
@@ -275,6 +269,5 @@ AGENTS.md              # AI agent context (imports from .maui/knowledge/)
 .github/
   workflows/
     reindex.yml        # weekly GitHub Actions reindex
-    claude-code-review.yml  # automated PR review via Claude
 .env.example
 ```