diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index bd6b5b9..b077158 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -10,6 +10,7 @@ on:
 
 permissions:
   contents: read
+  security-events: write
 
 jobs:
   semgrep:
@@ -17,16 +18,25 @@ jobs:
     runs-on: ubuntu-latest
     container:
       image: semgrep/semgrep
+
     steps:
       - name: Checkout code
         uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      # Scan this repository with the bundled secure-semgrep rules + Node/Python
-      # loadouts. Review mode (-e) records findings as evidence without breaking
-      # CI; run `mise run semgrep-strict` locally to enforce them as a gate.
-      - name: Run Semgrep (secure-semgrep)
-        run: bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py .
+      - name: Run Semgrep
+        id: semgrep
+        continue-on-error: true
+        run: |
+          semgrep scan \
+            --config apps/secure-semgrep/rules \
+            --config p/default \
+            --config p/security-audit \
+            --sarif \
+            --output=semgrep.sarif
 
-      # Keep the bundled rules honest: fail the build if any rule stops parsing.
-      - name: Validate bundled rules
-        run: semgrep scan --config apps/secure-semgrep/rules --validate
+      - name: Upload SARIF
+        # if fork PR, don't upload their SARIF
+        if: steps.semgrep.outcome == 'success' && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: github/codeql-action/upload-sarif@9fddc16f0de775b9edd8a84dd5839ac2db070f8b
+        with:
+          sarif_file: semgrep.sarif
diff --git a/.gitignore b/.gitignore
index 04794f8..316dd22 100644
--- a/.gitignore
+++ b/.gitignore
@@ -2,6 +2,8 @@
 .env.*
 !.env.example
 
+.sarif
+
 *node_modules/
 coverage/
 *dist/
diff --git a/mise.toml b/mise.toml
index 867cfe1..9248e16 100644
--- a/mise.toml
+++ b/mise.toml
@@ -7,6 +7,7 @@ ripgrep = "latest"
 jq = "latest"
 trivy = "latest"
 semgrep = "latest"
+snyk = "latest"
 
 [settings]
 minimum_release_age = "7d"
@@ -43,6 +44,12 @@ run = "pnpm -r --if-present format"
 description = "Verify shell sources are shfmt-clean"
 run = "pnpm -r --if-present format:check"
 
+[tasks.snyk-scan-deps]
+run = "snyk test --all-projects"
+
+[tasks.snyk-code-scan]
+run = "snyk code test --all-projects"
+
 [tasks.semgrep]
 # Full static-analysis pass over this repository (evidence mode: exits 0 so a
 # scan that finds issues still produces a report instead of breaking CI).
@@ -54,6 +61,9 @@ run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -e -L node -L py ."
 description = "Run secure-semgrep over the repo; exit 1 on any finding (gate)"
 run = "bash apps/secure-semgrep/bin/secure-semgrep.sh -L node -L py ."
 
+[tasks.semgrep-ci]
+run = "semgrep scan --config apps/secure-semgrep/rules --config p/default --config p/security-audit --sarif --output=semgrep.sarif"
+
 [tasks.semgrep-check]
 description = "Validate every bundled secure-semgrep rule parses"
 dir = "apps/secure-semgrep"