diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..5f09abb
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,8 @@
+# See https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-syntax
+
+# Paths that Dependabot PRs can touch
+/pyproject.toml @ynab/full-stack
+/poetry.lock @ynab/full-stack
+/requirements.txt @ynab/full-stack
+/test-requirements.txt @ynab/full-stack
+/.github/ @ynab/full-stack
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..f73ee00
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,22 @@
+# Documentation on this file: https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+#
+# Reviewers are assigned via .github/CODEOWNERS (the `reviewers` option was
+# retired by GitHub in favor of code owners).
+
+version: 2
+updates:
+  # Covers pyproject.toml/poetry.lock, requirements.txt, and test-requirements.txt
+  - package-ecosystem: "pip"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    open-pull-requests-limit: 3
+    cooldown:
+      default-days: 7