diff --git a/.github/workflows/branch-validation.yml b/.github/workflows/branch-validation.yml
new file mode 100644
index 0000000..6d75b77
--- /dev/null
+++ b/.github/workflows/branch-validation.yml
@@ -0,0 +1,10 @@
+name: branch-validation
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  branch-validation:
+    uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main
diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
new file mode 100644
index 0000000..92952e1
--- /dev/null
+++ b/.github/workflows/conventional-commit.yml
@@ -0,0 +1,10 @@
+name: conventional-commit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  conventional-commit:
+    uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8a65e73
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,15 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
+    secrets: inherit
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..abf7bd9
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,10 @@
+name: shellcheck
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    uses: nullplatform/actions-nullplatform/.github/workflows/shellcheck.yml@main
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
new file mode 100644
index 0000000..1a3c210
--- /dev/null
+++ b/.github/workflows/trivy.yml
@@ -0,0 +1,14 @@
+name: trivy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: nullplatform/actions-nullplatform/.github/workflows/trivy-tofu-scan.yml@main
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..da9ee64
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,10 @@
+# Trivy misconfiguration suppressions for this repo (intentional, documented).
+
+# AVD-DS-0002 — placeholder container images run as-is: the root http-echo
+# placeholder and the Lambda base image (public.ecr.aws/lambda/nodejs) manage the
+# runtime user themselves; a USER directive is not applicable.
+AVD-DS-0002
+
+# AVD-AWS-0031 — the placeholder ECR repo uses mutable 'latest-<arch>' tags by
+# design (a mirrored placeholder image, overwritten in place).
+AVD-AWS-0031
diff --git a/lambda/specs/requirements/main.tf b/lambda/specs/requirements/main.tf
index 402fc29..286f13a 100644
--- a/lambda/specs/requirements/main.tf
+++ b/lambda/specs/requirements/main.tf
@@ -352,7 +352,7 @@ resource "aws_ecr_repository" "lambda_placeholder" {
   image_tag_mutability = "MUTABLE"
 
   image_scanning_configuration {
-    scan_on_push = false
+    scan_on_push = true
   }
 
   tags = local.iam_default_tags