diff --git a/.github/dependabot.yml b/.github/dependabot.yml
deleted file mode 100644
index 4dc889c..0000000
--- a/.github/dependabot.yml
+++ /dev/null
@@ -1,29 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "docker"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "docker"
-
-  - package-ecosystem: "composer"
-    directory: "/app"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "composer"
-
-  - package-ecosystem: "composer"
-    directory: "/app/full"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "composer"
-
-  - package-ecosystem: "github-actions"
-    directory: "/"
-    schedule:
-      interval: "weekly"
-    commit-message:
-      prefix: "ci"
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
new file mode 100644
index 0000000..817c25a
--- /dev/null
+++ b/.github/workflows/dco.yml
@@ -0,0 +1,18 @@
+name: DCO
+
+# Enforced sign-off gate via the shared reusable (dependency bots exempt;
+# reports on merge_group). Humans must sign off (git commit -s).
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened]
+  merge_group:
+
+permissions: {}
+
+jobs:
+  dco:
+    uses: netresearch/.github/.github/workflows/dco.yml@main # NOSONAR — own-org reusable deliberately tracks main
+    permissions:
+      contents: read
+      pull-requests: read