diff --git a/socket.yml b/socket.yml
new file mode 100644
index 0000000..17eb040
--- /dev/null
+++ b/socket.yml
@@ -0,0 +1,21 @@
+# Socket.dev repo config (socket.yml v2; schema = @socketsecurity/config 3.0.1).
+#
+# WHAT THIS FILE BINDS: which Socket GitHub App surfaces run on this repo (the
+# "Socket Security: Pull Request Alerts" and "Project Report" checks, the PR
+# dependency table), the paths Socket ignores, and that no user is exempt.
+#
+# WHAT IT CANNOT BIND: the ACTION per alert type (block / warn / monitor / ignore).
+# That lives in the org Security Policy in the Socket dashboard, scoped by repo
+# label, and is enforced here by the branch ruleset requiring the
+# "Socket Security: Pull Request Alerts" check. A `deferTo:` block in this file is
+# SILENTLY DROPPED by the parser (verified 2026-09-02 with readSocketConfig, ops-3pdm)
+# — do not add one. `issueRules` here only takes booleans keyed by alert type.
+version: 2
+projectIgnorePaths:
+  - node_modules
+githubApp:
+  enabled: true
+  projectReportsEnabled: true
+  pullRequestAlertsEnabled: true
+  dependencyOverviewEnabled: true
+  ignoreUsers: []