diff --git a/bin/ci b/bin/ci
index b41a93ed0..4137ad5bb 100755
--- a/bin/ci
+++ b/bin/ci
@@ -1,12 +1,6 @@
 #!/usr/bin/env ruby
-
 require_relative "../config/boot"
 require "active_support/continuous_integration"
 
-ActiveSupport::ContinuousIntegration.run do
-  step "Security: Ruby", "bin/brakeman -q"
-  step "Security: JS", "bin/importmap audit"
-  step "Style: Ruby", "bin/rubocop"
-  step "Test: Unit", "bin/rails test"
-  # step "Test: System", "bin/rails test:system"
-end
+CI = ActiveSupport::ContinuousIntegration
+require_relative "../config/ci.rb"
diff --git a/config/ci.rb b/config/ci.rb
new file mode 100644
index 000000000..1a22e3e33
--- /dev/null
+++ b/config/ci.rb
@@ -0,0 +1,19 @@
+# Run using bin/ci
+
+CI.run do
+  step "Setup", "bin/setup"
+
+  step "Style: Ruby", "bin/rubocop"
+
+  step "Security: Gem audit", "bin/bundler-audit check --update"
+  step "Security: Importmap vulnerability audit", "bin/importmap audit"
+  step "Security: Brakeman code analysis", "bin/brakeman --quiet --no-pager --exit-on-warn --exit-on-error"
+
+  step "Tests: Rails", "bin/rails test"
+
+  if success?
+    step "Signoff: All systems go. Ready for merge and deploy.", "gh signoff"
+  else
+    failure "Signoff: CI failed. Do not merge or deploy.", "Fix the issues and try again."
+  end
+end