diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 83b75401..35364ee6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -106,4 +106,4 @@ jobs:
           name: dist
           path: dist/
       - name: Publish via Trusted Publishing
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..9fd1e6b7
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,18 @@
+# Security policy
+
+## Supported versions
+
+Security fixes land on the latest release. Earlier releases are not
+maintained.
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through GitHub's advisory form:
+
+<https://github.com/wolph/python-progressbar/security/advisories/new>
+
+That keeps the report out of the public issue tracker until a fix is
+available. If you cannot use the form, mail <Wolph@Wol.ph> instead.
+
+Please include the progressbar2 version, the configuration that triggers the
+issue and a minimal reproduction. Expect an acknowledgement within a week.
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index 8b3f9d36..7f84c364 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -114,6 +114,7 @@ bugs = 'https://github.com/wolph/python-progressbar/issues'
 documentation = 'https://progressbar-2.readthedocs.io/en/latest/'
 repository = 'https://github.com/wolph/python-progressbar/'
 Funding = 'https://github.com/sponsors/wolph'
+Changelog = 'https://github.com/wolph/python-progressbar/releases'
 
 [project.scripts]
 progressbar = 'progressbar.__main__:main'