diff --git a/.github/release-drafter.yml b/.github/release-drafter.yml
new file mode 100644
index 0000000..c1e938b
--- /dev/null
+++ b/.github/release-drafter.yml
@@ -0,0 +1,100 @@
+name-template: "v$RESOLVED_VERSION"
+tag-template: "v$RESOLVED_VERSION"
+version-template: "$MAJOR.$MINOR.$PATCH"
+change-template: "- $TITLE @$AUTHOR (#$NUMBER)"
+sort-direction: ascending
+
+categories:
+  - title: "💥 Breaking Changes"
+    labels:
+      - "breaking-change"
+  - title: "✨ New Features"
+    labels:
+      - "feature"
+      - "enhancement"
+  - title: "🐛 Bug Fixes"
+    labels:
+      - "fix"
+      - "bugfix"
+      - "bug"
+  - title: "🔧 Maintenance"
+    labels:
+      - "chore"
+      - "ci"
+      - "documentation"
+      - "dependencies"
+      - "refactor"
+      - "test"
+    collapse-after: 3
+
+autolabeler:
+  - label: "breaking-change"
+    title:
+      - '/^[a-z]+(\([^)]+\))?!:/i'
+  - label: "feature"
+    branch:
+      - "/^feat/"
+      - "/^feature/"
+    title:
+      - '/^feat(\([^)]+\))?:/i'
+  - label: "bugfix"
+    branch:
+      - "/^fix/"
+      - "/^bugfix/"
+    title:
+      - '/^fix(\([^)]+\))?:/i'
+  - label: "refactor"
+    branch:
+      - "/^refactor/"
+    title:
+      - '/^refactor(\([^)]+\))?:/i'
+  - label: "ci"
+    title:
+      - '/^ci(\([^)]+\))?:/i'
+  - label: "chore"
+    branch:
+      - "/^chore/"
+    title:
+      - '/^chore(\([^)]+\))?:/i'
+  - label: "documentation"
+    branch:
+      - "/^docs/"
+    title:
+      - '/^docs(\([^)]+\))?:/i'
+    files:
+      - "README.md"
+      - "docs/**/*"
+  - label: "test"
+    title:
+      - '/^test(\([^)]+\))?:/i'
+  - label: "dependencies"
+    branch:
+      - "/^dependabot/"
+    title:
+      - '/^build\(deps\):/i'
+      - '/^chore\(deps\):/i'
+      - '/^Bump /i'
+
+version-resolver:
+  major:
+    labels:
+      - "breaking-change"
+  minor:
+    labels:
+      - "feature"
+      - "enhancement"
+  patch:
+    labels:
+      - "bugfix"
+      - "bug"
+      - "fix"
+      - "refactor"
+      - "chore"
+      - "ci"
+      - "documentation"
+      - "dependencies"
+      - "test"
+  default: patch
+
+template: |
+  $CHANGES
diff --git a/.github/workflows/autolabeler.yml b/.github/workflows/autolabeler.yml
new file mode 100644
index 0000000..95bb653
--- /dev/null
+++ b/.github/workflows/autolabeler.yml
@@ -0,0 +1,34 @@
+name: Autolabeler
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  pull_request_target:
+    types: [opened, synchronize, reopened]
+
+permissions: {}
+
+concurrency:
+  group: ${{ format('al-{0}-pr-{1}', github.event_name, github.event.pull_request.number) }}
+  cancel-in-progress: true
+
+jobs:
+  autolabel:
+    name: Autolabel PR
+    if: >
+      (github.event_name == 'pull_request_target' && github.event.pull_request.head.repo.fork) ||
+      (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork)
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    permissions:
+      contents: read
+      pull-requests: write
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+
+      - uses: release-drafter/release-drafter/autolabeler@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml
new file mode 100644
index 0000000..b254611
--- /dev/null
+++ b/.github/workflows/dependabot-auto-merge.yml
@@ -0,0 +1,30 @@
+name: Dependabot Auto-Merge
+
+on: pull_request
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    if: github.actor == 'dependabot[bot]'
+    steps:
+      - name: Dependabot metadata
+        id: metadata
+        uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
+
+      - name: Auto-approve
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Enable auto-merge
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
new file mode 100644
index 0000000..ccf46ac
--- /dev/null
+++ b/.github/workflows/lint.yml
@@ -0,0 +1,41 @@
+# .NET's nearest equivalent to ruff check/format -- `dotnet format` runs the
+# same Roslyn analyzers/formatter the SDK already applies, `--verify-no-changes`
+# fails the job instead of writing changes, matching how ci lint jobs in this
+# org's other repos gate on format rather than auto-fix in CI.
+
+name: Lint
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+env:
+  DOTNET_NOLOGO: "1"
+  DOTNET_CLI_TELEMETRY_OPTOUT: "1"
+
+permissions: {}
+
+jobs:
+  format:
+    name: dotnet format
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+        with:
+          dotnet-version: "10.0.x"
+
+      - name: Check formatting
+        run: dotnet format IdentityFlow.slnx --verify-no-changes --verbosity diagnostic
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
new file mode 100644
index 0000000..89764fa
--- /dev/null
+++ b/.github/workflows/release-drafter.yml
@@ -0,0 +1,27 @@
+name: Release Drafter
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  update-release-draft:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+      pull-requests: read
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+        with:
+          egress-policy: audit
+
+      - uses: release-drafter/release-drafter@978bb0b30c5ee8cdd332ced253758157150d43f0 # v7.10.0
+        with:
+          config-name: release-drafter.yml
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}