diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md
new file mode 100644
index 000000000..a51756cc1
--- /dev/null
+++ b/CODE_OF_CONDUCT.md
@@ -0,0 +1,4 @@
+# Code of Conduct
+
+The repository code of conduct lives in
+[.github/CODE_OF_CONDUCT.md](.github/CODE_OF_CONDUCT.md).
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..dc9669e61
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,4 @@
+# Contributing
+
+Repository contribution guidance lives in
+[.github/CONTRIBUTING.md](.github/CONTRIBUTING.md).
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..95d87bf8b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,4 @@
+# Security
+
+Repository security and vulnerability reporting guidance lives in
+[.github/SECURITY.md](.github/SECURITY.md).
diff --git a/test/unit/scripts/repository-standard-docs.test.ts b/test/unit/scripts/repository-standard-docs.test.ts
new file mode 100644
index 000000000..42af68faa
--- /dev/null
+++ b/test/unit/scripts/repository-standard-docs.test.ts
@@ -0,0 +1,39 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { describe, expect, it } from 'vitest';
+
+const repoRoot = fileURLToPath(new URL('../../../', import.meta.url));
+
+function readRepoFile(relativePath: string): string {
+  return readFileSync(`${repoRoot}${relativePath}`, 'utf8');
+}
+
+describe('repository standard docs', () => {
+  it('keeps root pointers to the canonical GitHub standard docs', () => {
+    const pointers = [
+      {
+        rootPath: 'CODE_OF_CONDUCT.md',
+        githubPath: '.github/CODE_OF_CONDUCT.md',
+        heading: 'Code of Conduct',
+      },
+      {
+        rootPath: 'CONTRIBUTING.md',
+        githubPath: '.github/CONTRIBUTING.md',
+        heading: 'Contributing',
+      },
+      {
+        rootPath: 'SECURITY.md',
+        githubPath: '.github/SECURITY.md',
+        heading: 'Security',
+      },
+    ];
+
+    for (const pointer of pointers) {
+      expect(existsSync(`${repoRoot}${pointer.rootPath}`)).toBe(true);
+      expect(existsSync(`${repoRoot}${pointer.githubPath}`)).toBe(true);
+      const rootPointer = readRepoFile(pointer.rootPath);
+      expect(rootPointer).toContain(`[${pointer.githubPath}](${pointer.githubPath})`);
+      expect(rootPointer).toContain(`# ${pointer.heading}\n\n`);
+    }
+  });
+});