diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..2b78a90
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,7 @@
+# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#example-of-a-codeowners-file
+# This is a comment.
+# Each line is a file pattern followed by one or more owners.
+
+# These owners will be the default owners for everything in
+# the repo.
+* @johnko
diff --git a/.github/tf.sh b/.github/tf.sh
index c2a95ce..cdc537f 100644
--- a/.github/tf.sh
+++ b/.github/tf.sh
@@ -1,8 +1,17 @@
 #!/usr/bin/env bash
 set -eo pipefail
 
+if [[ -e .envrc ]]; then
+  set +x
+  # hide secret env values from output
+  # shellcheck disable=SC1091
+  source .envrc
+fi
+
 if [[ -z $IAC_BIN ]]; then
+  set -x
   export IAC_BIN=terraform
+  set +x
 fi
 
 WORKSPACE="$1"
@@ -29,7 +38,6 @@ case $SAFE_ACTION in
     echo "ACTION=$ACTION"
     ;;
   *)
-    set +x
     echo "ERROR: invalid 'ACTION', received '$ACTION'"
     exit 1
     ;;