diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..e669197
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,47 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'ocaml-dune/setup-dune@v2.1.0'
+    '.github/workflows/osv.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'lmdexpr/dune-lock-osv@main'
+dependencies:
+    'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7':
+        ref: 'v5.0.2'
+        commit: 'sha1-8b402f58fbc84540c8b491a91e594a4576fec3d7'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f':
+        ref: 'v6.0.0'
+        commit: 'sha1-b7c566a772e6b6bfb58ed0dc250532a479d7789f'
+        owner_id: 44036562
+        repo_id: 192625955
+    'lmdexpr/dune-lock-osv@main':
+        ref: 'main'
+        commit: 'sha1-7f1568fa0114081c2e949c4b07e1c01386adeea5'
+        owner_id: 4951592
+        repo_id: 1399418780
+        uses:
+            - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
+    'ocaml-dune/setup-dune@v2.1.0':
+        ref: 'v2.1.0'
+        commit: 'sha1-2201fa80f49561672943e7960e5f918c887ab0dc'
+        owner_id: 62877882
+        repo_id: 955896475
+        uses:
+            - 'actions/cache@8b402f58fbc84540c8b491a91e594a4576fec3d7'
+            - 'actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..d6270b8
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,37 @@
+# This workflow is managed by gh actions-lock.
+
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    strategy:
+      fail-fast: false
+      matrix:
+        # dune.lock is solved for linux and macos only
+        runs-on: [ ubuntu-latest, macos-latest ]
+    runs-on: ${{ matrix.runs-on }}
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - uses: ocaml-dune/setup-dune@v2.1.0
+        with:
+          # Keep in sync with the local dune; nightly would make dune.lock churn
+          version: 3.24.0
+      # Run here rather than in a separate job: @fmt needs the locked compiler
+      # this job already built, and a second job would race on the same cache key.
+      - name: Check formatting
+        if: runner.os == 'Linux'
+        run: |
+          dune tools install ocamlformat
+          eval "$(dune tools env)"
+          dune build @fmt
diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml
new file mode 100644
index 0000000..8713a6f
--- /dev/null
+++ b/.github/workflows/osv.yml
@@ -0,0 +1,31 @@
+# This workflow is managed by gh actions-lock.
+
+name: OSV
+
+on:
+  push:
+    branches: [ main ]
+    paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ]
+  pull_request:
+    paths: [ 'dune.lock/**', '.github/workflows/osv.yml', '.github/workflows/actions.lock' ]
+  schedule:
+    # New advisories land without any change on our side, so rescan daily.
+    - cron: '0 0 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  osv:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write # only for create-issue on schedule
+    steps:
+      - uses: actions/checkout@v7.0.1
+        with:
+          persist-credentials: false
+      - uses: lmdexpr/dune-lock-osv@main
+        with:
+          create-issue: ${{ github.event_name == 'schedule' }}
diff --git a/aws-lambda-eio.opam b/aws-lambda-eio.opam
index a52d5e3..92935b2 100644
--- a/aws-lambda-eio.opam
+++ b/aws-lambda-eio.opam
@@ -12,7 +12,7 @@ homepage: "https://github.com/lmdexpr/aws-lambda.ml"
 bug-reports: "https://github.com/lmdexpr/aws-lambda.ml/issues"
 depends: [
   "ocaml" {>= "5.3.0"}
-  "dune" {>= "3.23"}
+  "dune" {>= "3.24"}
   "aws-lambda" {= version}
   "eio"
   "cohttp-eio"
diff --git a/aws-lambda.opam b/aws-lambda.opam
index eb84bfa..676eb61 100644
--- a/aws-lambda.opam
+++ b/aws-lambda.opam
@@ -14,7 +14,7 @@ homepage: "https://github.com/lmdexpr/aws-lambda.ml"
 bug-reports: "https://github.com/lmdexpr/aws-lambda.ml/issues"
 depends: [
   "ocaml" {>= "5.3.0"}
-  "dune" {>= "3.23"}
+  "dune" {>= "3.24"}
   "alcotest" {with-test}
   "odoc" {with-doc}
 ]
diff --git a/dune-project b/dune-project
index af2fa1a..ef6c498 100644
--- a/dune-project
+++ b/dune-project
@@ -1,4 +1,4 @@
-(lang dune 3.23)
+(lang dune 3.24)
 
 (implicit_transitive_deps false)