diff --git a/.github/workflows/dev-security.yml b/.github/workflows/dev-security.yml
index 7d9a67c..259723d 100644
--- a/.github/workflows/dev-security.yml
+++ b/.github/workflows/dev-security.yml
@@ -1,7 +1,9 @@
 # The automated security review that stands in for a second developer on dev (policy rule 3).
+# Other repositories call it from a pull_request workflow; dependency review needs a pull request's base and head.
 name: dev-security
 on:
   pull_request:
+  workflow_call:
 
 permissions: {}
 
diff --git a/README.md b/README.md
index aefac0b..8d6e89e 100644
--- a/README.md
+++ b/README.md
@@ -7,6 +7,7 @@ same release controls as the projects it publishes.
 | Workflow | Purpose |
 |---|---|
 | `python-tests.yml`, `python-versions.yml`, `rust-tests.yml` | Test matrices |
+| `dev-security.yml` | Dependency review and workflow lint (`actionlint`, `zizmor`), the security checks `dev` requires |
 | `stable-guard.yml` | Checks a pull request into `stable` is release-ready: a MAJOR.MINOR.PATCH version, matching chart versions, no git dependencies |
 | `release-check.yml` | Runs on `stable` only: reads the version, refuses a partly published release, checks merged-PR provenance and that the `release` environment is protected |
 | `maturin-wheels.yml`, `crates.yml`, `docker.yml` | Build and publish artifacts |
@@ -34,6 +35,21 @@ environment. A reusable workflow gets an environment secret only when the caller
 name as above, alongside any other secrets such as `registry-token`. The caller's own job can't read the
 value; GitHub supplies it inside the environment.
 
+Call `dev-security.yml` from a workflow that runs on `pull_request`, with a job named `dev-security`, so the
+checks a `dev` ruleset requires are `dev-security / dependency-review` and `dev-security / workflow-lint`:
+
+```yaml
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  dev-security:
+    uses: blacklanternsecurity/release-workflows/.github/workflows/dev-security.yml@<full sha of the tag> # v1.1.0
+```
+
 ## How changes land
 
 - `dev`: pull request, required tests and security checks (CodeQL, dependency review, `actionlint`,
diff --git a/pyproject.toml b/pyproject.toml
index a23a3b4..e91c2f0 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -1,11 +1,11 @@
 [project]
 name = "release-workflows"
-version = "1.0.0"
+version = "1.1.0"
 requires-python = ">=3.11"
 dependencies = ["packaging", "pyyaml"]
 
 [dependency-groups]
-dev = ["pytest==9.0.2", "ruff==0.15.10", "actionlint-py==1.7.12.24"]
+dev = ["pytest==9.0.3", "ruff==0.15.10", "actionlint-py==1.7.12.24"]
 
 [tool.ruff]
 line-length = 160
diff --git a/uv.lock b/uv.lock
index c54a35c..f5ad840 100644
--- a/uv.lock
+++ b/uv.lock
@@ -55,7 +55,7 @@ wheels = [
 
 [[package]]
 name = "pytest"
-version = "9.0.2"
+version = "9.0.3"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "colorama", marker = "sys_platform == 'win32'" },
@@ -64,9 +64,9 @@ dependencies = [
     { name = "pluggy" },
     { name = "pygments" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/d1/db/7ef3487e0fb0049ddb5ce41d3a49c235bf9ad299b6a25d5780a89f19230f/pytest-9.0.2.tar.gz", hash = "sha256:75186651a92bd89611d1d9fc20f0b4345fd827c41ccd5c299a868a05d70edf11", size = 1568901, upload-time = "2025-12-06T21:30:51.014Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/7d/0d/549bd94f1a0a402dc8cf64563a117c0f3765662e2e668477624baeec44d5/pytest-9.0.3.tar.gz", hash = "sha256:b86ada508af81d19edeb213c681b1d48246c1a91d304c6c81a427674c17eb91c", size = 1572165, upload-time = "2026-04-07T17:16:18.027Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/3b/ab/b3226f0bd7cdcf710fbede2b3548584366da3b19b5021e74f5bde2a8fa3f/pytest-9.0.2-py3-none-any.whl", hash = "sha256:711ffd45bf766d5264d487b917733b453d917afd2b0ad65223959f59089f875b", size = 374801, upload-time = "2025-12-06T21:30:49.154Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/24/a372aaf5c9b7208e7112038812994107bc65a84cd00e0354a88c2c77a617/pytest-9.0.3-py3-none-any.whl", hash = "sha256:2c5efc453d45394fdd706ade797c0a81091eccd1d6e4bccfcd476e2b8e0ab5d9", size = 375249, upload-time = "2026-04-07T17:16:16.13Z" },
 ]
 
 [[package]]
@@ -126,7 +126,7 @@ wheels = [
 
 [[package]]
 name = "release-workflows"
-version = "1.0.0"
+version = "1.1.0"
 source = { virtual = "." }
 dependencies = [
     { name = "packaging" },
@@ -149,7 +149,7 @@ requires-dist = [
 [package.metadata.requires-dev]
 dev = [
     { name = "actionlint-py", specifier = "==1.7.12.24" },
-    { name = "pytest", specifier = "==9.0.2" },
+    { name = "pytest", specifier = "==9.0.3" },
     { name = "ruff", specifier = "==0.15.10" },
 ]