diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de1eda8..aed728e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,9 @@ on:
     branches: [ "main" ]
 
 permissions:
+  actions: read
   contents: read
+  security-events: write
 
 jobs:
   rubocop:
diff --git a/bin/rubocop b/bin/rubocop
new file mode 100755
index 0000000..369a05b
--- /dev/null
+++ b/bin/rubocop
@@ -0,0 +1,27 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+#
+# This file was generated by Bundler.
+#
+# The application 'rubocop' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../Gemfile", __dir__)
+
+bundle_binstub = File.expand_path("bundle", __dir__)
+
+if File.file?(bundle_binstub)
+  if File.read(bundle_binstub, 300).include?("This file was generated by Bundler")
+    load(bundle_binstub)
+  else
+    abort("Your `bin/bundle` was not generated by Bundler, so this binstub cannot run.
+Replace `bin/bundle` by running `bundle binstubs bundler --force`, then run this command again.")
+  end
+end
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("rubocop", "rubocop")
diff --git a/dev.yml b/dev.yml
index 158f5d9..471b04c 100644
--- a/dev.yml
+++ b/dev.yml
@@ -8,3 +8,4 @@ up:
 
 commands:
   test: bin/rake test
+  style: bin/rubocop -a