diff --git a/.github/workflows/lint-web.yml b/.github/workflows/lint-web.yml
index c638d4e7..f34d3af3 100644
--- a/.github/workflows/lint-web.yml
+++ b/.github/workflows/lint-web.yml
@@ -37,8 +37,9 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
         with:
+          package_json_file: web/package.json
           cache: true
-          version: 11
+          run_install: false
 
       - name: Install deps
         working-directory: web
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ecab0ce1..32de4689 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,8 +94,9 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
         with:
+          package_json_file: web/package.json
           cache: true
-          version: 11
+          run_install: false
 
       - name: Build frontend
         working-directory: web
@@ -103,6 +104,19 @@ jobs:
           pnpm install --ignore-scripts --frozen-lockfile
           pnpm build
 
+      - name: Build source code archive
+        run: tar --exclude='.github' --exclude-vcs --exclude-vcs-ignores --xform='s|^\./|proxy-${{ env.VERSION }}/|' --xz -cf ${{ runner.temp }}/defguard-proxy-${{ env.VERSION }}.tar.xz .
+
+      - name: Upload source code archive
+        uses: shogo82148/actions-upload-release-asset@394b3c11c3cfc038b5396ad265c074065cf875c3 # v1.10.2
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ needs.create-release.outputs.upload_url }}
+          asset_path: ${{ runner.temp }}/defguard-proxy-${{ env.VERSION }}.tar.xz
+          asset_content_type: application/x-xz
+          overwrite: true
+
       - name: Install Rust stable
         uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
         with:
@@ -353,14 +367,14 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@008330803749db0355799c700092d9a85fd074e9 # v6.0.9
         with:
-          version: 11
+          package_json_file: web/package.json
+          cache: true
+          run_install: false
 
-      # Change to '--frozen-lockfile' once this gets fixed:
-      # https://github.com/pnpm/action-setup/issues/40
       - name: Build frontend
         working-directory: web
         run: |
-          pnpm install --ignore-scripts --no-frozen-lockfile
+          pnpm install --ignore-scripts --frozen-lockfile
           pnpm build
 
       - name: Install Rust stable
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 388ea019..85cbae9f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -71,7 +71,7 @@ jobs:
           tool: cargo-deny
 
       - name: Run cargo deny
-        run: cargo deny check
+        run: cargo deny check --hide-inclusion-graph
 
       - name: Run tests
         run: cargo test --locked --no-fail-fast
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
index ba363f0c..15b9fe59 100644
--- a/.trivyignore.yaml
+++ b/.trivyignore.yaml
@@ -1,10 +1 @@
-vulnerabilities:
-  - id: GHSA-w5hq-g745-h8pq
-    expired_at: 2026-05-23
-    statement: "Waiting for upstream patch in paraglide"
-  - id: CVE-2026-29111
-    expired_at: 2026-05-31
-    statement: "No fixed version available in debian:13-slim - waiting for Debian to backport systemd patch"
-  - id: CVE-2025-69720
-    expired_at: 2026-05-31
-    statement: "No fixed version available in debian:13-slim - waiting for Debian to release ncurses patch"
+vulnerabilities: []
diff --git a/package.json b/package.json
index 18c8c1d5..bc46481f 100644
--- a/package.json
+++ b/package.json
@@ -1,4 +1,5 @@
 {
+	"packageManager": "pnpm@11.9.0",
 	"devDependencies": {
 		"@tanstack/devtools-vite": "^0.3.12"
 	}
diff --git a/renovate.json b/renovate.json
new file mode 100644
index 00000000..0f3a2535
--- /dev/null
+++ b/renovate.json
@@ -0,0 +1,4 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["github>DefGuard/ci-workflows//renovate/default.json"]
+}
diff --git a/web/package.json b/web/package.json
index a212482e..9e82a09f 100644
--- a/web/package.json
+++ b/web/package.json
@@ -2,6 +2,7 @@
   "name": "web",
   "private": true,
   "version": "0.0.1",
+  "packageManager": "pnpm@11.9.0",
   "type": "module",
   "scripts": {
     "dev": "vite",