diff --git a/.github/workflows/ruby.yml b/.github/workflows/ruby.yml
index f382d37..2046df3 100644
--- a/.github/workflows/ruby.yml
+++ b/.github/workflows/ruby.yml
@@ -25,6 +25,10 @@ jobs:
       with:
         ruby-version: ${{ matrix.ruby-version }}
         bundler-cache: true # runs 'bundle install' and caches installed gems automatically
+    - name: Run RuboCop
+      run: bundle exec rubocop
+    - name: Run Bundler Audit
+      run: bundle exec bundle-audit check --update
     - name: Run tests
       env:
         GOOGLE_ACCOUNT_TYPE: ${{ secrets.GOOGLE_ACCOUNT_TYPE }}
@@ -34,5 +38,3 @@ jobs:
         GOOGLE_CLIENT_ID: ${{ secrets.GOOGLE_CLIENT_ID }}
         GOOGLE_PRIVATE_KEY: ${{ secrets.GOOGLE_PRIVATE_KEY }}
       run: bundle exec rake spec
-    - name: Run RuboCop
-      run: bundle exec rubocop
diff --git a/Gemfile b/Gemfile
index 87da6ec..65b7b75 100644
--- a/Gemfile
+++ b/Gemfile
@@ -13,6 +13,7 @@ group :development, :test do
 end
 
 group :test do
+  gem 'bundler-audit', require: false
   gem 'byebug', require: false
   gem 'rspec', require: false
   gem 'simplecov', require: false
diff --git a/Gemfile.lock b/Gemfile.lock
index 5a1086d..bee8caf 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -12,6 +12,9 @@ GEM
     ast (2.4.2)
     base64 (0.2.0)
     bigdecimal (3.1.8)
+    bundler-audit (0.9.2)
+      bundler (>= 1.2.0, < 3)
+      thor (~> 1.0)
     byebug (11.1.3)
     crack (1.0.0)
       bigdecimal
@@ -113,6 +116,7 @@ GEM
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.13.1)
     simplecov_json_formatter (0.1.4)
+    thor (1.3.2)
     trailblazer-option (0.1.2)
     uber (0.1.0)
     unicode-display_width (2.6.0)
@@ -129,6 +133,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  bundler-audit
   byebug
   rake (~> 13.0)
   rspec
diff --git a/README.md b/README.md
index 5a4494a..032b079 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,16 @@ After checking out the repo, run `bin/setup` to install dependencies. Then, run
 
 To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and the created tag, and push the `.gem` file to [rubygems.org](https://rubygems.org).
 
+### linting
+
+GitHub Action runs
+* RuboCop
+* Bundler Audit
+
+### testing
+
+RSpec tests require the environment variables listed in spec_helper.rb's `REQUIRED_VARS` constant.
+
 ## Contributing
 
 Bug reports and pull requests are welcome on GitHub at https://github.com/eebbesen/sheet_zoukas.