diff --git a/.github/workflows/copyright.yml b/.github/workflows/copyright.yml
new file mode 100644
index 0000000..8d84980
--- /dev/null
+++ b/.github/workflows/copyright.yml
@@ -0,0 +1,63 @@
+# SPDX-FileCopyrightText: Estonian Information System Authority
+# SPDX-License-Identifier: MIT
+
+name: Copyright headers
+on:
+  workflow_call:
+    inputs:
+      pattern:
+        description: Extended regular expression that a valid header must match
+        type: string
+        # Deliberately also accepts third party notices, e.g. vendored headers carrying
+        # someone else's copyright. The check is whether a file has a notice at all,
+        # not whether the notice names us.
+        default: SPDX-FileCopyrightText|Copyright|free software
+      extensions:
+        description: Space separated list of file extensions to check
+        type: string
+        default: c cpp cxx h hpp m mm swift cs java kt kts php js mjs cjs ts tsx py sh ps1 applescript ui xml manifest yml yaml svg css qss html rc wxs wxl desktop zsh preinst postinst prerm postrm entitlements strings qrc def fbs i gradle cmake csproj
+      filenames:
+        description: Space separated list of file names to check, for files without a usable extension
+        type: string
+        default: CMakeLists.txt rules
+      exclude:
+        description: Extended regular expression of paths to skip
+        type: string
+        default: ''
+permissions:
+  contents: read
+jobs:
+  copyright:
+    name: Check copyright headers
+    runs-on: ubuntu-slim
+    steps:
+    - name: Checkout
+      uses: actions/checkout@v6
+    - name: Check
+      env:
+        PATTERN: ${{ inputs.pattern }}
+        EXTENSIONS: ${{ inputs.extensions }}
+        FILENAMES: ${{ inputs.filenames }}
+        EXCLUDE: ${{ inputs.exclude }}
+      run: |
+        extre="\.($(echo "$EXTENSIONS" | tr ' ' '|'))$"
+        # Dots are escaped so that e.g. CMakeLists.txt does not also match CMakeListsXtxt
+        namere="^($(echo "$FILENAMES" | sed 's/\./\\./g' | tr ' ' '|'))$"
+        fail=0
+        checked=0
+        while IFS= read -r file; do
+          # Skips submodule links and directories
+          [ -f "$file" ] || continue
+          if ! [[ "$file" =~ $extre ]]; then
+            { [ -n "$FILENAMES" ] && [[ "$(basename "$file")" =~ $namere ]]; } || continue
+          fi
+          if [ -n "$EXCLUDE" ] && [[ "$file" =~ $EXCLUDE ]]; then continue; fi
+          checked=$((checked + 1))
+          if ! head -n 20 "$file" | grep -E "$PATTERN" >/dev/null; then
+            # The file is repeated in the message, the log only shows the message text
+            echo "::error file=$file,line=1::$file has no copyright header matching '$PATTERN'"
+            fail=1
+          fi
+        done < <(git ls-files)
+        echo "Checked $checked file(s)"
+        exit $fail
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 396f390..a2af852 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -36,6 +36,8 @@ Reading up on [secure coding](https://www.securecoding.cert.org/confluence/displ
 
 
 # Issues and support
-Official builds are provided through official distribution point [id.ee](https://www.id.ee/en/article/install-id-software/). If you want support, you need to be using official builds. Contact our support via www.id.ee for assistance.
+Official builds are available through the official distribution point [id.ee](https://www.id.ee/en/article/install-id-software/). If you need support, please make sure you are using an official build and contact our support via [id.ee](https://www.id.ee/en/article/notify-us-of-the-problem/).
 
-Source code is provided on "as is" terms with no warranty (see license for more information). Do not file Github issues with generic support requests.
+The source code is provided on an “as is” basis, without warranty. See the applicable license for more information. Please do not use GitHub Issues for general support requests.
+
+If you discover a security vulnerability, please report it to CERT-EE at cert@cert.ee. Please do not disclose security vulnerabilities publicly through GitHub Issues.