diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d267043..0591d1d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -29,6 +29,6 @@ jobs:
         with:
           name: dist
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      - uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           attestations: true
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..218ce32
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,18 @@
+# Security policy
+
+## Supported versions
+
+Security fixes land on the latest release. Earlier releases are not
+maintained.
+
+## Reporting a vulnerability
+
+Report vulnerabilities privately through GitHub's advisory form:
+
+<https://github.com/wolph/python-utils/security/advisories/new>
+
+That keeps the report out of the public issue tracker until a fix is
+available. If you cannot use the form, mail <Wolph@Wol.ph> instead.
+
+Please include the python-utils version, the configuration that triggers the
+issue and a minimal reproduction. Expect an acknowledgement within a week.
\ No newline at end of file
diff --git a/pyproject.toml b/pyproject.toml
index def39e7..1fbda4a 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -52,6 +52,7 @@ Documentation = 'https://python-utils.readthedocs.io/'
 Repository = 'https://github.com/WoLpH/python-utils'
 Changelog = 'https://github.com/WoLpH/python-utils/releases'
 Funding = 'https://github.com/sponsors/wolph'
+Issues = 'https://github.com/wolph/python-utils/issues'
 
 [project.optional-dependencies]
 loguru = ['loguru']