diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 00000000..e608291b
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,22 @@
+<!--
+SPDX-License-Identifier: CC-BY-SA-4.0
+SPDX-FileCopyrightText: 2025-2026 Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
+-->
+
+# Security Policy
+
+**The security policy for this repository lives in [`SECURITY.adoc`](SECURITY.adoc).**
+
+Please read that file — it is the authoritative document.
+
+## Why this file exists
+
+This estate writes prose in AsciiDoc, so every community-health document here is `.adoc`.
+That is a deliberate convention, not an omission.
+
+Some tools only look for the literal filename `SECURITY.md` and report the policy as
+missing when they do not find it — Glama counts a repository as having no security policy
+without it. This pointer satisfies that check without duplicating the policy text, so
+there is exactly one source of truth.
+
+Do not copy the policy into this file; it will drift.