diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d9272c6..c68b2ea 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,3 +34,8 @@ jobs:
       - run: npm ci
       - run: npm run typecheck
       - run: npm run build
+
+  # Renovate reports vulnerabilities already on main; this one blocks a PR that
+  # is about to add a new dependency with a known advisory.
+  dependency-review:
+    uses: EduIDE/.github/.github/workflows/dependency-review.yml@v1