diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db03f47..f7aa9b2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -5,6 +5,8 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  schedule:
+    - cron: '0 0 * * 1'  # Weekly security scan on Mondays
 
 permissions:
   contents: read
@@ -85,3 +87,24 @@ jobs:
 
       - name: Run mypy
         run: mypy app tests || true   # non-blocking until types are fully clean
+
+  security:
+    name: Security scan (pip-audit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+          cache: pip
+          cache-dependency-path: |
+            requirements.txt
+            requirements-dev.txt
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+          pip install pip-audit
+      - name: Run pip-audit
+        run: pip-audit -r requirements.txt