diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..c7d837e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: weekly
+- package-ecosystem: "pip"
+  directory: "/"
+  schedule:
+    interval: weekly
diff --git a/.github/workflows/dependencies.yaml b/.github/workflows/dependencies.yaml
new file mode 100644
index 0000000..8869384
--- /dev/null
+++ b/.github/workflows/dependencies.yaml
@@ -0,0 +1,20 @@
+name: dependencies
+
+on:
+  pull_request:
+    paths:
+    - requirements*
+
+jobs:
+  compile:
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.12'
+        cache: 'pip'
+    - run: python -m pip install pip-tools
+    - run: pip-compile requirements.in
+    - run: git diff --exit-code
diff --git a/requirements-dev.txt b/requirements.in
similarity index 100%
rename from requirements-dev.txt
rename to requirements.in
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..ef451cf
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1,126 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile requirements.in
+#
+attrs==23.2.0
+    # via
+    #   glom
+    #   jsonschema
+    #   referencing
+    #   semgrep
+boltons==21.0.0
+    # via
+    #   face
+    #   glom
+    #   semgrep
+bracex==2.4
+    # via wcmatch
+certifi==2024.6.2
+    # via requests
+charset-normalizer==3.3.2
+    # via requests
+click==8.1.7
+    # via
+    #   click-option-group
+    #   fixit
+    #   moreorless
+    #   semgrep
+click-option-group==0.5.6
+    # via semgrep
+colorama==0.4.6
+    # via semgrep
+covdefaults==2.3.0
+    # via -r requirements.in
+coverage==7.5.4
+    # via
+    #   -r requirements.in
+    #   covdefaults
+defusedxml==0.7.1
+    # via semgrep
+exceptiongroup==1.2.1
+    # via semgrep
+face==22.0.0
+    # via glom
+fixit==2.1.0
+    # via -r requirements.in
+flake8==7.1.0
+    # via -r requirements.in
+glom==22.1.0
+    # via semgrep
+idna==3.7
+    # via requests
+iniconfig==2.0.0
+    # via pytest
+jsonschema==4.22.0
+    # via semgrep
+jsonschema-specifications==2023.12.1
+    # via jsonschema
+libcst==1.4.0
+    # via fixit
+markdown-it-py==3.0.0
+    # via rich
+mccabe==0.7.0
+    # via flake8
+mdurl==0.1.2
+    # via markdown-it-py
+moreorless==0.4.0
+    # via fixit
+packaging==24.1
+    # via
+    #   fixit
+    #   pytest
+    #   semgrep
+pathspec==0.12.1
+    # via trailrunner
+peewee==3.17.5
+    # via semgrep
+pluggy==1.5.0
+    # via pytest
+pycodestyle==2.12.0
+    # via flake8
+pyflakes==3.2.0
+    # via flake8
+pygments==2.18.0
+    # via rich
+pytest==8.2.2
+    # via
+    #   -r requirements.in
+    #   pytest-subprocess
+pytest-subprocess==1.5.0
+    # via -r requirements.in
+pyyaml==6.0.1
+    # via libcst
+referencing==0.35.1
+    # via
+    #   jsonschema
+    #   jsonschema-specifications
+requests==2.32.3
+    # via semgrep
+rich==13.7.1
+    # via semgrep
+rpds-py==0.18.1
+    # via
+    #   jsonschema
+    #   referencing
+ruamel-yaml==0.17.40
+    # via semgrep
+ruamel-yaml-clib==0.2.8
+    # via ruamel-yaml
+ruff==0.5.0
+    # via -r requirements.in
+semgrep==1.78.0
+    # via -r requirements.in
+tomli==2.0.1
+    # via semgrep
+trailrunner==1.4.0
+    # via fixit
+typing-extensions==4.12.2
+    # via semgrep
+urllib3==2.2.2
+    # via
+    #   requests
+    #   semgrep
+wcmatch==8.5.2
+    # via semgrep
diff --git a/tox.ini b/tox.ini
index e13269f..802af89 100644
--- a/tox.ini
+++ b/tox.ini
@@ -2,7 +2,7 @@
 envlist = py39,py310,py311,py312
 
 [testenv]
-deps = -rrequirements-dev.txt
+deps = -rrequirements.txt
 commands =
   coverage erase
   coverage run -m pytest {posargs:tests}