diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..60df717
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,8 @@
+version: 2
+updates:
+  - package-ecosystem: 'github-actions'
+    directory: '/'
+    schedule:
+      interval: 'daily'
+    commit-message:
+      prefix: 'chore(ci)'
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
new file mode 100644
index 0000000..b530e67
--- /dev/null
+++ b/.github/workflows/dependency-review.yml
@@ -0,0 +1,26 @@
+name: Dependency review
+
+on:
+  pull_request:
+    branches: [master]
+
+# Ensures review for a previous commit will be completed before reviewing a following commit.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+permissions: {}
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/dependency-review-action@v4
+        with:
+          comment-summary-in-pr: on-failure
diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml
new file mode 100644
index 0000000..5cd567a
--- /dev/null
+++ b/.github/workflows/lint-pr-title.yml
@@ -0,0 +1,66 @@
+name: Lint PR title
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
+    branches: [master]
+
+# Ensures linting for a previous PR title will be completed before linting a modified title.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+
+permissions: {}
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    permissions:
+      pull-requests: read
+    outputs:
+      error_message: ${{ steps.lint.outputs.error_message }}
+
+    steps:
+      - uses: amannn/action-semantic-pull-request@v5
+        id: lint
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          subjectPattern: '^[A-Z].+[^.]$'
+          subjectPatternError: |
+            The subject found in the pull request title didn't match the configured pattern.
+
+            Please ensure that the subject "{subject}":
+            - does start with an uppercase character,
+            - does not end with a period.
+
+  report:
+    if: ${{ always() }}
+    needs: lint
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    permissions:
+      pull-requests: write
+
+    steps:
+      - uses: marocchino/sticky-pull-request-comment@v2
+        if: ${{ needs.lint.outputs.error_message != null }}
+        with:
+          header: pr-title-lint-error
+          message: |
+            Hey there and thank you for opening this pull request! 👋
+
+            We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted.
+
+            Details:
+
+            ```
+            ${{ needs.lint.outputs.error_message }}
+            ```
+
+      # Delete a previous comment when the issue has been resolved.
+      - uses: marocchino/sticky-pull-request-comment@v2
+        if: ${{ needs.lint.outputs.error_message == null }}
+        with:
+          header: pr-title-lint-error
+          delete: true
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
new file mode 100644
index 0000000..853a48b
--- /dev/null
+++ b/.github/workflows/test.yml
@@ -0,0 +1,53 @@
+name: Test
+
+on:
+  push:
+    tags: ["v*"]
+    branches: ["master"]
+  pull_request:
+    branches: ["master"]
+  workflow_dispatch:
+
+# Cancel testing of a previous commit for the same branch.
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: jdx/mise-action@v2
+
+      - name: Cache .buildcache
+        uses: actions/cache@v4
+        with:
+          path: .buildcache
+          key: build-v1-${{ runner.os }}-${{ hashFiles('.*.version') }}-${{ hashFiles('tests/.config/nvim/lazy-lock.json') }}
+          restore-keys: |
+            build-v1-${{ runner.os }}-${{ hashFiles('.*.version') }}-
+            build-v1-${{ runner.os }}-
+
+      - run: mise ls
+
+      - run: mise run deps/tests/restore
+
+      - name: WORKAROUND Restore rest of test dependencies
+        run: |
+          # Lazy on 1st run restores all but itself and hererocks, so try again.
+          git checkout -- tests/.config/nvim/lazy-lock.json
+          mise run deps/tests/restore
+
+      - run: mise run test
+
+      - name: Check is generated doc up-to-date
+        run: |
+          mise run generate/panvimdoc
+          test -z "$(git status --porcelain -- ./doc)"
diff --git a/mise.lock b/mise.lock
index 26b01f9..cd59a23 100644
--- a/mise.lock
+++ b/mise.lock
@@ -4,6 +4,6 @@ neovim = [
     "0.10.2",
     "0.9.0",
 ]
-"ubi:JohnnyMorganz/stylua" = "0.20.0"
+"ubi:JohnnyMorganz/stylua" = "2.0.1"
 "ubi:Kampfkarren/selene" = "0.27.1"
 "ubi:jgm/pandoc" = "3.5"
diff --git a/mise.toml b/mise.toml
index 8c45eb8..688b4a4 100644
--- a/mise.toml
+++ b/mise.toml
@@ -25,11 +25,7 @@ depends = ['lint', 'test/*']
 run = 'nvim -l tests/run.lua --minitest'
 
 [tasks.'test/0.9']
-run = '''
-eval "$(mise activate --shims)"
-eval "$(mise sh neovim@0.9)"
-nvim -u tests/shim_nvim-0.9.lua -l tests/run.lua --minitest
-'''
+run = 'mise exec neovim@0.9 -- nvim -u tests/shim_nvim-0.9.lua -l tests/run.lua --minitest'
 
 [tasks.lint]
 depends = ['lint/*']
@@ -42,11 +38,12 @@ run = 'selene .'
 
 [tasks.'generate/panvimdoc']
 env.DIR = '.buildcache/panvimdoc'
-run = '''set -eo pipefail
-export PANVIMDOC_VER="$(cat .panvimdoc.version)"
+shell = 'bash -eo pipefail -c'
+run = '''
+VER="$(cat .panvimdoc.version)"
 test -d $DIR || git clone https://github.com/kdheepak/panvimdoc $DIR
-git -C $DIR co $PANVIMDOC_VER 2>/dev/null || (git -C $DIR fetch && git -C $DIR co $PANVIMDOC_VER)
-$DIR/panvimdoc.sh \
+git -C $DIR checkout $VER 2>/dev/null || (git -C $DIR fetch && git -C $DIR checkout $VER)
+GITHUB_ACTIONS= $DIR/panvimdoc.sh \
     --project-name ruscmd \
     --description 'NORMAL and CMDLINE modes support in Russian keyboard layout' \
     --input-file README.md \
diff --git a/tests/run.lua b/tests/run.lua
index d658583..104491b 100644
--- a/tests/run.lua
+++ b/tests/run.lua
@@ -17,6 +17,7 @@ vim.env.XDG_STATE_HOME = vim.uv.cwd() .. '/.buildcache/tests/state'
 ---@type LazyConfig
 local config = {
     defaults = { version = '*' },
+    rocks = { hererocks = true },
     spec = {
         'lunarmodules/luassert',
         {
diff --git a/tests/test_ruscmd.lua b/tests/test_ruscmd.lua
index 6f7d64f..10d2afb 100644
--- a/tests/test_ruscmd.lua
+++ b/tests/test_ruscmd.lua
@@ -40,9 +40,13 @@ describe('cabbrev', function()
         child.lua [[ require('ruscmd').setup {} ]]
         child.type_keys 'Жив!<CR>'
         assert.same({ '' }, child_lines())
-        assert.error_matches(function()
+        local err = assert.error(function()
             child.type_keys 'Жй<CR>'
-        end, 'Invalid channel')
+        end)
+        assert.is_true(
+            err:match 'Invalid channel' ~= nil or err:match 'closed by the client' ~= nil,
+            string.format('error %q matches "Invalid channel" or "closed by the client"', err)
+        )
     end)
 
     it('should add new command', function()