diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..9d37356
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,2 @@
+We don't take code contributions right now — see [CONTRIBUTING.md](../CONTRIBUTING.md).
+Spotted a wrong or misleading claim, a typo, or a security issue? File an issue (or a private vulnerability report) and we'll act on it — credited.
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 0000000..e6202f5
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,19 @@
+# Contributing
+
+This repository is the fosterstack.com website, and the same contribution
+model as [fosterstack/cache](https://github.com/fosterstack/cache/blob/main/CONTRIBUTING.md)
+applies: **we don't take code contributions right now.** Not a judgment of
+anyone's work — the implementation here is done by AI agents under automated
+gates, and an outside diff is the one input that can't go through those
+gates unreviewed.
+
+What we want, and will act on:
+
+- **Issues** — a typo, a claim that reads wrong, a page that misled you, an
+  accessibility problem. Copy corrections move fastest of all.
+- **Security reports** for anything on the site, through GitHub's private
+  vulnerability reporting. Send the report, not the patch; you'll be
+  credited in the fix.
+
+Pull requests stay enabled for our own tooling; an outside PR gets a
+friendly close with a link here and its substance re-filed as an issue.
diff --git a/bin/check-file-allowlist.sh b/bin/check-file-allowlist.sh
index a3f738d..a9dea35 100755
--- a/bin/check-file-allowlist.sh
+++ b/bin/check-file-allowlist.sh
@@ -11,6 +11,8 @@
 set -euo pipefail
 
 ALLOW_PATTERNS=(
+  '^CONTRIBUTING\.md$'
+  '^\.github/PULL_REQUEST_TEMPLATE\.md$'
   '^index\.html$'
   '^README\.md$'
   '^LICENSE$'