diff --git a/.github/workflows/branch-validation.yml b/.github/workflows/branch-validation.yml
new file mode 100644
index 0000000..6d75b77
--- /dev/null
+++ b/.github/workflows/branch-validation.yml
@@ -0,0 +1,10 @@
+name: branch-validation
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  branch-validation:
+    uses: nullplatform/actions-nullplatform/.github/workflows/branch-validation.yml@main
diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
new file mode 100644
index 0000000..92952e1
--- /dev/null
+++ b/.github/workflows/conventional-commit.yml
@@ -0,0 +1,10 @@
+name: conventional-commit
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  conventional-commit:
+    uses: nullplatform/actions-nullplatform/.github/workflows/conventional-commit.yml@main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..8a65e73
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,15 @@
+name: release
+
+on:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release:
+    uses: nullplatform/actions-nullplatform/.github/workflows/release.yml@main
+    secrets: inherit
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
new file mode 100644
index 0000000..abf7bd9
--- /dev/null
+++ b/.github/workflows/shellcheck.yml
@@ -0,0 +1,10 @@
+name: shellcheck
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  shellcheck:
+    uses: nullplatform/actions-nullplatform/.github/workflows/shellcheck.yml@main
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
new file mode 100644
index 0000000..1a3c210
--- /dev/null
+++ b/.github/workflows/trivy.yml
@@ -0,0 +1,14 @@
+name: trivy
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  trivy:
+    uses: nullplatform/actions-nullplatform/.github/workflows/trivy-tofu-scan.yml@main
diff --git a/aurora-postgres-server/deployment/main.tf b/aurora-postgres-server/deployment/main.tf
index 6e42294..9c7efd6 100644
--- a/aurora-postgres-server/deployment/main.tf
+++ b/aurora-postgres-server/deployment/main.tf
@@ -59,6 +59,26 @@ resource "aws_secretsmanager_secret_version" "master" {
   })
 }
 
+# ---------------------------------------------------------------------------
+# KMS key for Aurora storage encryption (customer managed, required by
+# AVD-AWS-0079 — the default AWS-managed RDS key doesn't satisfy that check)
+# ---------------------------------------------------------------------------
+
+resource "aws_kms_key" "aurora" {
+  description         = "Customer managed key for Aurora cluster storage encryption (${var.instance_name})"
+  enable_key_rotation = true
+
+  tags = {
+    "managed-by" = "nullplatform"
+    "service-id" = var.service_id
+  }
+}
+
+resource "aws_kms_alias" "aurora" {
+  name          = "alias/nullplatform-aurora-${var.instance_name}"
+  target_key_id = aws_kms_key.aurora.key_id
+}
+
 # ---------------------------------------------------------------------------
 # Aurora PostgreSQL cluster
 # ---------------------------------------------------------------------------
@@ -85,6 +105,7 @@ resource "aws_rds_cluster" "main" {
   vpc_security_group_ids = [aws_security_group.aurora.id]
 
   storage_encrypted   = true
+  kms_key_id          = aws_kms_key.aurora.arn
   port                = 5432
   skip_final_snapshot = true
   deletion_protection = false