diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000..ec0cacc
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,17 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned versions current.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+
+  # Keep Python dependencies current.
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..b781e14
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,35 @@
+name: CodeQL
+
+# Static security analysis (free for public repositories). Scans the Python
+# backend and the vanilla-JS frontend on pushes, PRs, and weekly.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 601f43d..bc73b63 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -7,6 +7,12 @@ name: Release
 on:
   push:
     tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image tag to publish (e.g. 1.1.2); leave blank for just :latest"
+        required: false
+        default: ""
 
 permissions:
   contents: read
@@ -40,6 +46,7 @@ jobs:
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
             type=raw,value=latest
 
       - name: Build and push
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a3ba438..a5cc3e5 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to this project are documented here. The format is based
 on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.1.2] - 2026-06-10
+
+First release with a published container image and security tooling. No
+application behavior changes from 1.1.1.
+
+### Added
+- Prebuilt multi-arch (amd64 + arm64) container image published to GitHub
+  Container Registry: `ghcr.io/allennpit/ads-bit`.
+- CodeQL code-scanning workflow (Python + JavaScript) and Dependabot updates
+  for GitHub Actions and pip.
+- `workflow_dispatch` trigger on the release workflow for manual image builds.
+
 ## [1.1.1] - 2026-06-10
 
 ### Added
@@ -43,6 +55,7 @@ on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
   pixel-art sprites, directional backgrounds, weather, sun/moon, admin panel,
   first-run setup wizard, and Docker/Podman support.
 
+[1.1.2]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.2
 [1.1.1]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.1
 [1.1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.0
 [1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.0
diff --git a/server.py b/server.py
index ddef493..69cebb3 100755
--- a/server.py
+++ b/server.py
@@ -17,7 +17,7 @@ from aiohttp import web, ClientSession, ClientTimeout
 import netifaces
 import bcrypt
 
-VERSION = "1.1.1"
+VERSION = "1.1.2"
 
 WEB_DIR = Path(__file__).parent
 # Config path is overridable (handy for containers persisting config on a