diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..6aca381
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1,5 @@
+# Universal Commerce Protocol (UCP) Codeowners
+*  @Universal-Commerce-Protocol/devops-maintainers
+
+# Governance
+/.github/CODEOWNERS      @Universal-Commerce-Protocol/governance-council
diff --git a/SECURITY.md b/SECURITY.md
deleted file mode 100644
index b01d986..0000000
--- a/SECURITY.md
+++ /dev/null
@@ -1,23 +0,0 @@
-<!--
-   Copyright 2026 UCP Authors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
--->
-
-# Security Policy
-
-To report a security issue, please use [g.co/vulnz](https://g.co/vulnz).
-
-The Google Security Team will respond within 5 working days of your report on g.co/vulnz.
-
-We use g.co/vulnz for our intake, and do coordination and disclosure here using GitHub Security Advisory to privately discuss and fix the issue.