diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 5bb8a98..a01ffda 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,10 @@ updates:
     schedule:
       interval: "weekly"
   - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "pip"
     directory: "/"
     schedule:
       interval: "weekly"
\ No newline at end of file
diff --git a/.github/workflows/linters.yml b/.github/workflows/linters.yml
index bf63a2e..066e1d3 100644
--- a/.github/workflows/linters.yml
+++ b/.github/workflows/linters.yml
@@ -13,6 +13,7 @@ jobs:
   docker-lint:
     if: ${{ !github.event.act }} # skip during local actions testing
     runs-on: ubuntu-latest
+    timeout-minutes: 10
     steps:
       - uses: actions/checkout@v6
       - uses: hadolint/hadolint-action@v3.3.0
@@ -22,6 +23,7 @@ jobs:
 
   python-lint-Jammy:
     runs-on: ubuntu-22.04
+    timeout-minutes: 30
 
     strategy:
       fail-fast: false
@@ -74,6 +76,7 @@ jobs:
 
   python-lint-Noble:
     runs-on: ubuntu-24.04
+    timeout-minutes: 30
 
     strategy:
       fail-fast: false
diff --git a/.github/workflows/meson-test.yml b/.github/workflows/meson-test.yml
index 4442044..205af44 100644
--- a/.github/workflows/meson-test.yml
+++ b/.github/workflows/meson-test.yml
@@ -5,12 +5,19 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+  schedule:
+    - cron: '0 4 * * 0'  # Sundays at 4:00 AM UTC
 
   workflow_dispatch:
 
 jobs:
   meson-build:
-    runs-on: ubuntu-24.04
+    runs-on: ${{ matrix.os }}
+    timeout-minutes: 60
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04]
     steps:
       - name: "CHECKOUT: nvme-stas"
         uses: actions/checkout@v6
@@ -18,7 +25,13 @@ jobs:
       - name: "INSTALL: build packages"
         run: |
           sudo apt update
-          sudo apt-get install --yes --quiet meson ninja-build cmake
+          sudo apt-get install --yes --quiet ninja-build cmake
+          # Jammy ships meson 0.61 which is too old; install a newer version via pip
+          if [ "${{ matrix.os }}" = "ubuntu-22.04" ]; then
+            pip install meson
+          else
+            sudo apt-get install --yes --quiet meson
+          fi
 
       - name: "INSTALL: python packages"
         run: |
diff --git a/README.md b/README.md
index 55838ea..4a94783 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # nvme-stas - NVMe STorage Appliance Services (STAS)
 
 ![Build](https://github.com/linux-nvme/nvme-stas/actions/workflows/meson-test.yml/badge.svg)
+![CodeQL](https://github.com/linux-nvme/nvme-stas/actions/workflows/codeql.yml/badge.svg)
 ![GitHub](https://img.shields.io/github/license/linux-nvme/nvme-stas)
 [![Ruff](https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/astral-sh/ruff/main/assets/badge/v2.json)](https://github.com/astral-sh/ruff)
 [![Release](https://img.shields.io/github/v/release/linux-nvme/nvme-stas?include_prereleases&style=)](https://github.com/linux-nvme/nvme-stas/releases)