diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..fbe2564
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+# Weekly automated dependency-update PRs.
+#   gomod           — Go modules in go.mod (direct + indirect)
+#   github-actions  — action versions used in .github/workflows
+version: 2
+updates:
+  - package-ecosystem: gomod
+    directory: /
+    schedule:
+      interval: weekly
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 97d9fce..fe5d573 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,6 +18,11 @@ jobs:
         with:
           go-version-file: go.mod
 
+      - name: go.mod tidy check
+        run: |
+          go mod tidy
+          git diff --exit-code go.mod go.sum
+
       - name: Vet
         run: go vet ./...
 
diff --git a/go.mod b/go.mod
index 9e1a198..d987678 100644
--- a/go.mod
+++ b/go.mod
@@ -1,12 +1,12 @@
 module github.com/vars-cli/vars
 
-go 1.25.0
+go 1.25.11
 
 require (
 	filippo.io/age v1.3.1
 	github.com/spf13/cobra v1.10.2
-	golang.org/x/crypto v0.46.0
-	golang.org/x/term v0.41.0
+	golang.org/x/crypto v0.53.0
+	golang.org/x/term v0.44.0
 	gopkg.in/yaml.v3 v3.0.1
 )
 
@@ -14,5 +14,5 @@ require (
 	filippo.io/hpke v0.4.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/spf13/pflag v1.0.9 // indirect
-	golang.org/x/sys v0.42.0 // indirect
+	golang.org/x/sys v0.46.0 // indirect
 )
diff --git a/go.sum b/go.sum
index 9daba39..fd7a791 100644
--- a/go.sum
+++ b/go.sum
@@ -13,12 +13,12 @@ github.com/spf13/cobra v1.10.2/go.mod h1:7C1pvHqHw5A4vrJfjNwvOdzYu0Gml16OCs2GRiT
 github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
 github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/crypto v0.46.0 h1:cKRW/pmt1pKAfetfu+RCEvjvZkA9RimPbh7bhFjGVBU=
-golang.org/x/crypto v0.46.0/go.mod h1:Evb/oLKmMraqjZ2iQTwDwvCtJkczlDuTmdJXoZVzqU0=
-golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
-golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.41.0 h1:QCgPso/Q3RTJx2Th4bDLqML4W6iJiaXFq2/ftQF13YU=
-golang.org/x/term v0.41.0/go.mod h1:3pfBgksrReYfZ5lvYM0kSO0LIkAl4Yl2bXOkKP7Ec2A=
+golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto=
+golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio=
+golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw=
+golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc=
+golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
diff --git a/justfile b/justfile
index aec3ec6..1ac1746 100644
--- a/justfile
+++ b/justfile
@@ -34,6 +34,11 @@ lint:
 [group('dev')]
 check: vet lint test
 
+# Scan for known vulnerabilities that are actually reachable (govulncheck)
+[group('dev')]
+audit:
+    go run golang.org/x/vuln/cmd/govulncheck@latest ./...
+
 # Run unit tests
 [group('test')]
 test:
diff --git a/scripts/smoke.sh b/scripts/smoke.sh
index ea44f5f..5c6ac95 100755
--- a/scripts/smoke.sh
+++ b/scripts/smoke.sh
@@ -1,7 +1,10 @@
 #!/usr/bin/env bash
 # End-to-end smoke test for the ssh-v1 (v0.6) vars. Uses a dedicated SSH key so
-# it's deterministic and needs no ssh-agent. git versioning is best-effort: the
-# log/version check is skipped where the store isn't a git repo.
+# encryption is deterministic and needs no ssh-agent. git versioning is a soft
+# dependency: checks that need it are skipped when the store isn't a git repo —
+# but if it IS one, an early gate fails fast when commits aren't landing (e.g. a
+# global signed-commit config with the signing key not in ssh-agent) instead of
+# masking it and dying confusingly at the end.
 set -euo pipefail
 
 BIN="${1:-./vars}"
@@ -21,6 +24,18 @@ $BIN set RPC_URL https://rpc.example.com
 $BIN set PRIVATE_KEY 0xTESTKEY
 $BIN set ETHERSCAN_API abc123
 
+# vars auto-commits are best-effort: a failed commit only warns and still exits
+# 0, so the rest of this suite would silently run against an unversioned store.
+# If the store is a git repo, the sets above MUST have produced a commit — an
+# unborn HEAD means versioning is broken (commonly a global commit.gpgsign=true
+# with the signing key not loaded in ssh-agent). Detect it now and quit clearly.
+if [ -d "$VARS_STORE_DIR/.git" ] && ! git -C "$VARS_STORE_DIR" rev-parse --verify -q HEAD >/dev/null; then
+    echo "SMOKE FAIL: the store is a git repo but no commit was created — git versioning is broken." >&2
+    echo "  Likely a global signed-commit config (commit.gpgsign=true) with the signing key not in" >&2
+    echo "  ssh-agent. Load it with 'ssh-add', or disable signing for this run, then retry." >&2
+    exit 1
+fi
+
 echo "--- get ---"
 test "$($BIN get RPC_URL)" = "https://rpc.example.com"