diff --git a/.coderabbit.yaml b/.coderabbit.yaml
new file mode 100644
index 00000000..8cc17544
--- /dev/null
+++ b/.coderabbit.yaml
@@ -0,0 +1,166 @@
+language: "en-US"
+
+reviews:
+  profile: "chill"
+  request_changes_workflow: true
+  high_level_summary: false
+  high_level_summary_in_walkthrough: false
+  poem: false
+  in_progress_fortune: false
+  review_status: true
+  review_details: true
+  collapse_walkthrough: true
+  changed_files_summary: true
+  sequence_diagrams: true
+  estimate_code_review_effort: true
+  assess_linked_issues: true
+  related_issues: true
+  related_prs: true
+  suggested_labels: true
+  auto_apply_labels: false
+  suggested_reviewers: true
+  auto_assign_reviewers: false
+  enable_prompt_for_ai_agents: true
+  abort_on_close: true
+
+  path_filters:
+    - "!vendor/**"
+
+  path_instructions:
+    - path: "src/grub2/**"
+      instructions: >
+        These files are installed as static GRUB configuration on target
+        systems. Review changes for valid syntax, bootability, and compatibility
+        across the supported firmware and architecture combinations.
+    - path: "src/backend/**"
+      instructions: >
+        Backend and state-file changes affect persistent bootloader update state.
+        Preserve compatibility with existing state and ensure updates remain
+        atomic and recoverable after interruption.
+    - path: "tests/**"
+      instructions: >
+        These are integration and black-box tests. New or changed behavior
+        should include appropriate coverage, including failure and recovery
+        paths where relevant.
+    - path: "systemd/**"
+      instructions: >
+        Unit changes affect boot ordering and privilege boundaries. Check that
+        dependencies, installation paths, and service behavior remain safe.
+
+  auto_review:
+    enabled: true
+    drafts: false
+    auto_incremental_review: true
+    ignore_title_keywords:
+      - "WIP"
+      - "DO NOT MERGE"
+
+  finishing_touches:
+    docstrings:
+      enabled: false
+    unit_tests:
+      enabled: true
+    autofix:
+      enabled: true
+
+  pre_merge_checks:
+    title:
+      mode: "warning"
+      requirements: >
+        PR title must follow the format 'subsystem: lowercase description'.
+        Examples: 'src/efi: improve ESP handling', 'tests: add recovery coverage',
+        'ci: update toolchain', '*: refactor bootloader interface'. Use
+        imperative mood, lowercase after colon, and no trailing period.
+    description:
+      mode: "warning"
+    custom_checks:
+      - name: "Commit message convention"
+        mode: "warning"
+        instructions: >
+          Check that every non-merge commit message in this PR follows the
+          format 'subsystem: lowercase description'. The subsystem is typically
+          a file path prefix (e.g., 'src/efi', 'src/grub2', 'tests', 'ci'), a
+          component name (e.g., 'esp', 'build'), or '*' for cross-cutting
+          changes. After the colon and space, the description must start with a
+          lowercase letter and use imperative mood (e.g., 'add', 'fix',
+          'update', not 'Added', 'Fixes', 'Updates'). There must be no trailing
+          period. Merge commits (starting with 'Merge') should be ignored. Flag
+          any commit that does not conform.
+
+  tools:
+    golangci-lint:
+      enabled: false
+    shellcheck:
+      enabled: true
+    yamllint:
+      enabled: true
+    markdownlint:
+      enabled: true
+    hadolint:
+      enabled: true
+    actionlint:
+      enabled: true
+    zizmor:
+      enabled: true
+    gitleaks:
+      enabled: true
+    trufflehog:
+      enabled: true
+    clippy:
+      enabled: true
+    # Disable tools irrelevant to this Rust project.
+    checkov:
+      enabled: false
+    clang:
+      enabled: false
+    cppcheck:
+      enabled: false
+    ruff:
+      enabled: false
+    biome:
+      enabled: false
+    eslint:
+      enabled: false
+    phpstan:
+      enabled: false
+    phpmd:
+      enabled: false
+    phpcs:
+      enabled: false
+    swiftlint:
+      enabled: false
+    detekt:
+      enabled: false
+    rubocop:
+      enabled: false
+    flake8:
+      enabled: false
+    pylint:
+      enabled: false
+    oxc:
+      enabled: false
+    stylelint:
+      enabled: false
+    htmlhint:
+      enabled: false
+    brakeman:
+      enabled: false
+    fortitudeLint:
+      enabled: false
+    shopifyThemeCheck:
+      enabled: false
+    luacheck:
+      enabled: false
+    prismaLint:
+      enabled: false
+    sqlfluff:
+      enabled: false
+    squawk:
+      enabled: false
+    dotenvLint:
+      enabled: false
+    buf:
+      enabled: false
+
+chat:
+  auto_reply: true