diff --git a/SECURITY-INSIGHTS.yml b/SECURITY-INSIGHTS.yml
new file mode 100644
index 000000000..4389e7a2d
--- /dev/null
+++ b/SECURITY-INSIGHTS.yml
@@ -0,0 +1,101 @@
+header:
+  schema-version: 2.2.0
+  last-updated: '2026-09-02'
+  last-reviewed: '2026-09-02'
+  url: https://github.com/velero-io/velero/blob/main/SECURITY-INSIGHTS.yml
+  comment: |
+    OpenSSF Security Insights manifest for the Velero project.
+
+project:
+  name: Velero
+  homepage: https://velero.io
+  roadmap: https://github.com/velero-io/velero/blob/main/ROADMAP.md
+  administrators:
+    - name: Scott Seago
+      affiliation: Red Hat
+      primary: false
+    - name: Daniel Jiang
+      affiliation: Broadcom
+      primary: true
+    - name: Wenkai Yin
+      affiliation: Broadcom
+      primary: false
+    - name: Xun Jiang
+      affiliation: Broadcom
+      primary: false
+    - name: Shubham Pampattiwar
+      affiliation: Red Hat
+      primary: false
+    - name: Yonghui Li
+      affiliation: Broadcom
+      primary: false
+    - name: Anshul Ahuja
+      affiliation: Microsoft Azure
+      primary: false
+    - name: Tiger Kaovilai
+      affiliation: Red Hat
+      primary: false
+  documentation:
+    detailed-guide: https://velero.io/docs/
+  repositories:
+    - name: velero
+      url: https://github.com/velero-io/velero
+      comment: |
+        velero is the core repository for the Velero project.
+  vulnerability-reporting:
+    reports-accepted: true
+    bug-bounty-available: false
+    contact:
+      name: Velero Security Team
+      email: cncf-velero-security@lists.cncf.io
+      primary: true
+    comment: |
+      Report vulnerabilities privately to the Velero Security Team by email or
+      via GitHub private vulnerability reporting on the repository Security tab.
+      See the security policy for full details.
+
+repository:
+  url: https://github.com/velero-io/velero
+  status: active
+  accepts-change-request: true
+  accepts-automated-change-request: true
+  core-team:
+    - name: Scott Seago
+      affiliation: Red Hat
+      primary: false
+    - name: Daniel Jiang
+      affiliation: Broadcom
+      primary: true
+    - name: Wenkai Yin
+      affiliation: Broadcom
+      primary: false
+    - name: Xun Jiang
+      affiliation: Broadcom
+      primary: false
+    - name: Shubham Pampattiwar
+      affiliation: Red Hat
+      primary: false
+    - name: Yonghui Li
+      affiliation: Broadcom
+      primary: false
+    - name: Anshul Ahuja
+      affiliation: Microsoft Azure
+      primary: false
+    - name: Tiger Kaovilai
+      affiliation: Red Hat
+      primary: false
+  license:
+    url: https://github.com/velero-io/velero/blob/main/LICENSE
+    expression: Apache-2.0
+  documentation:
+    contributing-guide: https://velero.io/docs/main/start-contributing/
+    governance: https://github.com/velero-io/.github/blob/main/GOVERNANCE.md
+    security-policy: https://github.com/velero-io/.github/blob/main/SECURITY.md
+    dependency-management-policy: https://github.com/velero-io/velero/blob/main/site/content/docs/main/development.md#dependency-management
+  security:
+    assessments:
+      self:
+        comment: |
+          A formal third-party security assessment has not yet been completed.
+          The project follows the CNCF security disclosure and response process
+          documented in the security policy.
diff --git a/site/content/docs/main/development.md b/site/content/docs/main/development.md
index 6d0fa5227..c6d9f5811 100644
--- a/site/content/docs/main/development.md
+++ b/site/content/docs/main/development.md
@@ -47,3 +47,14 @@ velero install --crds-only --dry-run -o yaml | kubectl apply -f -
 
 **NOTE:** You could change the default CRD API version (v1beta1 _or_ v1) if Velero CLI can't discover the Kubernetes preferred CRD API version. The Kubernetes version < 1.16 preferred CRD API version is v1beta1; the Kubernetes version >= 1.16 preferred CRD API version is v1.
 
+
+## Dependency management
+
+Velero is written in Go and uses [Go modules](https://go.dev/ref/mod) to manage its dependencies. Direct and indirect dependencies are declared in `go.mod` and pinned in `go.sum`.
+
+The project keeps dependencies up to date and responds to upstream security fixes as follows:
+
+* [Dependabot](https://docs.github.com/en/code-security/dependabot) is configured in [`.github/dependabot.yml`](https://github.com/velero-io/velero/blob/main/.github/dependabot.yml) to open pull requests for Go module and GitHub Actions updates on a weekly schedule. Updates are grouped to reduce noise.
+* Dependency update pull requests follow the same review process as any other change: they must pass CI and be approved by a maintainer before merging.
+* Security-relevant updates are prioritized. Vulnerabilities in dependencies that affect Velero are handled through the [security release process](https://github.com/velero-io/.github/blob/main/SECURITY.md).
+* New direct dependencies should be kept to a minimum and use a license compatible with Velero's [Apache 2.0 license](https://github.com/velero-io/velero/blob/main/LICENSE).