diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 000000000..9827a5bba
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,19 @@
+name: Dependency Review
+# Blocks pull requests that introduce dependencies with known vulnerabilities.
+# Uses GitHub's Dependency Graph to diff base...head, so it only runs on PRs.
+on: [pull_request]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubicloud-standard-8
+    steps:
+      - uses: actions/checkout@v4
+      - name: Dependency Review
+        uses: actions/dependency-review-action@v4
+        with:
+          # Fail the check when a PR adds a dependency with a high or critical
+          # advisory. Lower the threshold to `moderate`/`low` to tighten.
+          fail-on-severity: high