From c7c5c0b2cf3ef2a670f635f81f093d6c7691202d Mon Sep 17 00:00:00 2001
From: Alexander Bantyev <balsoft@balsoft.ru>
Date: Mon, 2 Mar 2026 22:12:48 +0100
Subject: [PATCH 1/2] teams/security-review: init

The Security Review team reviews changes to core packages for Nixpkgs
security vulnerabilities.

See also: https://github.com/nixOS/nixpkgs/issues/494349
---
 maintainers/team-list.nix | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/maintainers/team-list.nix b/maintainers/team-list.nix
index bad67fd029fe..37503bf6abe6 100644
--- a/maintainers/team-list.nix
+++ b/maintainers/team-list.nix
@@ -719,6 +719,10 @@ with lib.maintainers;
     enableFeatureFreezePing = true;
   };
 
+  security-review = {
+    github = "security-review";
+  };
+
   stdenv = {
     enableFeatureFreezePing = true;
     github = "stdenv";

From 2839911e818e43a879670066882fabf589f9c218 Mon Sep 17 00:00:00 2001
From: Alexander Bantyev <balsoft@balsoft.ru>
Date: Mon, 2 Mar 2026 22:15:52 +0100
Subject: [PATCH 2/2] various: add security-review team as a maintainer

Adds the @NixOS/security-review team as a maintainer to multiple
packages deemed to be important security-wise.

For the motivation of the package list, see:
https://github.com/NixOS/nixpkgs/issues/494349#issuecomment-4005099033
---
 pkgs/applications/networking/sync/rsync/default.nix   | 1 +
 pkgs/by-name/au/audit/package.nix                     | 1 +
 pkgs/by-name/bo/boehmgc/package.nix                   | 1 +
 pkgs/by-name/ca/cacert/package.nix                    | 1 +
 pkgs/by-name/cu/curlMinimal/package.nix               | 1 +
 pkgs/by-name/gi/git/package.nix                       | 1 +
 pkgs/by-name/li/libcap_ng/package.nix                 | 1 +
 pkgs/by-name/li/libsodium/package.nix                 | 1 +
 pkgs/by-name/lo/logrotate/package.nix                 | 1 +
 pkgs/by-name/op/openresolv/package.nix                | 1 +
 pkgs/by-name/sh/shadow/package.nix                    | 1 +
 pkgs/by-name/ut/util-linux/package.nix                | 1 +
 pkgs/development/compilers/gcc/common/meta.nix        | 5 ++++-
 pkgs/development/compilers/llvm/common/common-let.nix | 5 ++++-
 pkgs/development/interpreters/perl/interpreter.nix    | 5 ++++-
 pkgs/development/libraries/acl/default.nix            | 1 +
 pkgs/development/libraries/attr/default.nix           | 1 +
 pkgs/development/libraries/glibc/common.nix           | 1 +
 pkgs/development/libraries/openssl/default.nix        | 1 +
 pkgs/development/libraries/sqlite/default.nix         | 1 +
 pkgs/development/libraries/zlib/default.nix           | 1 +
 pkgs/os-specific/linux/busybox/default.nix            | 1 +
 pkgs/os-specific/linux/iptables/default.nix           | 1 +
 pkgs/os-specific/linux/kernel/build.nix               | 5 ++++-
 pkgs/os-specific/linux/kmod/default.nix               | 1 +
 pkgs/os-specific/linux/systemd/default.nix            | 5 ++++-
 pkgs/shells/bash/5.nix                                | 1 +
 pkgs/tools/misc/coreutils/default.nix                 | 1 +
 pkgs/tools/misc/findutils/default.nix                 | 1 +
 pkgs/tools/networking/openssh/common.nix              | 1 +
 pkgs/tools/package-management/nix/default.nix         | 5 ++++-
 pkgs/tools/security/gnupg/24.nix                      | 1 +
 pkgs/tools/text/gnugrep/default.nix                   | 1 +
 33 files changed, 51 insertions(+), 6 deletions(-)

diff --git a/pkgs/applications/networking/sync/rsync/default.nix b/pkgs/applications/networking/sync/rsync/default.nix
index b98c39cc1baa..ce6b5264213a 100644
--- a/pkgs/applications/networking/sync/rsync/default.nix
+++ b/pkgs/applications/networking/sync/rsync/default.nix
@@ -92,6 +92,7 @@ stdenv.mkDerivation rec {
     maintainers = with lib.maintainers; [
       ivan
     ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.unix;
     identifiers.cpeParts = {
       vendor = "samba";
diff --git a/pkgs/by-name/au/audit/package.nix b/pkgs/by-name/au/audit/package.nix
index 236234cee014..dbb8cd25ea56 100644
--- a/pkgs/by-name/au/audit/package.nix
+++ b/pkgs/by-name/au/audit/package.nix
@@ -170,6 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/linux-audit/audit-userspace/releases/tag/v4.1.2";
     license = lib.licenses.gpl2Plus;
     maintainers = with lib.maintainers; [ grimmauld ];
+    teams = [ lib.teams.security-review ];
     pkgConfigModules = [
       "audit"
       "auparse"
diff --git a/pkgs/by-name/bo/boehmgc/package.nix b/pkgs/by-name/bo/boehmgc/package.nix
index 136d9e9c005f..dbc471dea7fc 100644
--- a/pkgs/by-name/bo/boehmgc/package.nix
+++ b/pkgs/by-name/bo/boehmgc/package.nix
@@ -119,6 +119,7 @@ stdenv.mkDerivation (finalAttrs: {
     changelog = "https://github.com/bdwgc/bdwgc/blob/v${finalAttrs.version}/ChangeLog";
     license = lib.licenses.boehmGC;
     maintainers = [ ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     identifiers.cpeParts =
       lib.meta.cpeFullVersionWithVendor "boehm-demers-weiser" finalAttrs.version
diff --git a/pkgs/by-name/ca/cacert/package.nix b/pkgs/by-name/ca/cacert/package.nix
index bb52e8104f18..e79b8e67c3f0 100644
--- a/pkgs/by-name/ca/cacert/package.nix
+++ b/pkgs/by-name/ca/cacert/package.nix
@@ -33,6 +33,7 @@ let
       fpletz
       lukegb
     ];
+    teams = [ lib.teams.security-review ];
     license = lib.licenses.mpl20;
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "mozilla" version // {
       product = "nss";
diff --git a/pkgs/by-name/cu/curlMinimal/package.nix b/pkgs/by-name/cu/curlMinimal/package.nix
index 57b03c5f33a5..d1cac99d8a5a 100644
--- a/pkgs/by-name/cu/curlMinimal/package.nix
+++ b/pkgs/by-name/cu/curlMinimal/package.nix
@@ -285,6 +285,7 @@ stdenv.mkDerivation (finalAttrs: {
     maintainers = with lib.maintainers; [
       Scrumplex
     ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     # Fails to link against static gss
     broken = stdenv.hostPlatform.isStatic && gssSupport;
diff --git a/pkgs/by-name/gi/git/package.nix b/pkgs/by-name/gi/git/package.nix
index 671100e76947..6cc2ccf5c9f9 100644
--- a/pkgs/by-name/gi/git/package.nix
+++ b/pkgs/by-name/gi/git/package.nix
@@ -617,6 +617,7 @@ stdenv.mkDerivation (finalAttrs: {
       philiptaron
       zivarah
     ];
+    teams = [ lib.teams.security-review ];
     mainProgram = "git";
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "git-scm" finalAttrs.version;
   };
diff --git a/pkgs/by-name/li/libcap_ng/package.nix b/pkgs/by-name/li/libcap_ng/package.nix
index c5fab14e7db0..373e4c04b730 100644
--- a/pkgs/by-name/li/libcap_ng/package.nix
+++ b/pkgs/by-name/li/libcap_ng/package.nix
@@ -63,6 +63,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.linux;
     license = lib.licenses.lgpl21;
     maintainers = with lib.maintainers; [ grimmauld ];
+    teams = [ lib.teams.security-review ];
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "libcap-ng_project" finalAttrs.version;
   };
 })
diff --git a/pkgs/by-name/li/libsodium/package.nix b/pkgs/by-name/li/libsodium/package.nix
index 8cb1249f1da9..bb68d9f5da45 100644
--- a/pkgs/by-name/li/libsodium/package.nix
+++ b/pkgs/by-name/li/libsodium/package.nix
@@ -56,6 +56,7 @@ stdenv.mkDerivation (finalAttrs: {
       mdaniels5757
       raskin
     ];
+    teams = [ lib.teams.security-review ];
     pkgConfigModules = [ "libsodium" ];
     platforms = lib.platforms.all;
   };
diff --git a/pkgs/by-name/lo/logrotate/package.nix b/pkgs/by-name/lo/logrotate/package.nix
index c4f49d4b420c..a8777014bf48 100644
--- a/pkgs/by-name/lo/logrotate/package.nix
+++ b/pkgs/by-name/lo/logrotate/package.nix
@@ -57,6 +57,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Rotates and compresses system logs";
     license = lib.licenses.gpl2Plus;
     maintainers = [ lib.maintainers.tobim ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     mainProgram = "logrotate";
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "logrotate_project" finalAttrs.version;
diff --git a/pkgs/by-name/op/openresolv/package.nix b/pkgs/by-name/op/openresolv/package.nix
index 853cf18b12ff..579106c2fd40 100644
--- a/pkgs/by-name/op/openresolv/package.nix
+++ b/pkgs/by-name/op/openresolv/package.nix
@@ -43,6 +43,7 @@ stdenv.mkDerivation (finalAttrs: {
     homepage = "https://roy.marples.name/projects/openresolv";
     license = lib.licenses.bsd2;
     maintainers = [ ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.unix;
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "openresolv_project" finalAttrs.version;
   };
diff --git a/pkgs/by-name/sh/shadow/package.nix b/pkgs/by-name/sh/shadow/package.nix
index a506c9f96e27..6fa34fdb5ab7 100644
--- a/pkgs/by-name/sh/shadow/package.nix
+++ b/pkgs/by-name/sh/shadow/package.nix
@@ -132,6 +132,7 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Suite containing authentication-related tools such as passwd and su";
     license = lib.licenses.bsd3;
     maintainers = with lib.maintainers; [ mdaniels5757 ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.linux;
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "shadow_project" finalAttrs.version;
   };
diff --git a/pkgs/by-name/ut/util-linux/package.nix b/pkgs/by-name/ut/util-linux/package.nix
index 27dd6e4abe9b..4fa7935b58cc 100644
--- a/pkgs/by-name/ut/util-linux/package.nix
+++ b/pkgs/by-name/ut/util-linux/package.nix
@@ -245,6 +245,7 @@ stdenv.mkDerivation (finalAttrs: {
       publicDomain
     ];
     maintainers = with lib.maintainers; [ numinit ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.unix;
     pkgConfigModules = [
       "blkid"
diff --git a/pkgs/development/compilers/gcc/common/meta.nix b/pkgs/development/compilers/gcc/common/meta.nix
index cf6b3447231e..ba96e80a633f 100644
--- a/pkgs/development/compilers/gcc/common/meta.nix
+++ b/pkgs/development/compilers/gcc/common/meta.nix
@@ -27,7 +27,10 @@ in
   '';
 
   platforms = platforms.unix;
-  teams = [ teams.gcc ];
+  teams = [
+    teams.gcc
+    teams.security-review
+  ];
   mainProgram = "${targetPrefix}gcc";
 
   identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version;
diff --git a/pkgs/development/compilers/llvm/common/common-let.nix b/pkgs/development/compilers/llvm/common/common-let.nix
index b6b570d628ae..84fd098ff3fa 100644
--- a/pkgs/development/compilers/llvm/common/common-let.nix
+++ b/pkgs/development/compilers/llvm/common/common-let.nix
@@ -20,7 +20,10 @@ rec {
           asl20
           llvm-exception
         ];
-    teams = [ lib.teams.llvm ];
+    teams = [
+      lib.teams.llvm
+      lib.teams.security-review
+    ];
 
     # See llvm/cmake/config-ix.cmake.
     platforms =
diff --git a/pkgs/development/interpreters/perl/interpreter.nix b/pkgs/development/interpreters/perl/interpreter.nix
index 06bfeee4cd71..fce8e1c9e0f0 100644
--- a/pkgs/development/interpreters/perl/interpreter.nix
+++ b/pkgs/development/interpreters/perl/interpreter.nix
@@ -359,7 +359,10 @@ stdenv.mkDerivation (
       description = "Standard implementation of the Perl 5 programming language";
       license = lib.licenses.artistic1;
       maintainers = [ ];
-      teams = [ lib.teams.perl ];
+      teams = [
+        lib.teams.perl
+        lib.teams.security-review
+      ];
       platforms = lib.platforms.all;
       priority = 6; # in `buildEnv' (including the one inside `perl.withPackages') the library files will have priority over files in `perl`
       mainProgram = "perl";
diff --git a/pkgs/development/libraries/acl/default.nix b/pkgs/development/libraries/acl/default.nix
index be4fbcd6cdde..9bba05fd90bf 100644
--- a/pkgs/development/libraries/acl/default.nix
+++ b/pkgs/development/libraries/acl/default.nix
@@ -40,6 +40,7 @@ stdenv.mkDerivation rec {
     homepage = "https://savannah.nongnu.org/projects/acl";
     description = "Library and tools for manipulating access control lists";
     license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.security-review ];
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "acl_project" version;
   };
 }
diff --git a/pkgs/development/libraries/attr/default.nix b/pkgs/development/libraries/attr/default.nix
index 0c8897ef0160..f2e057a33058 100644
--- a/pkgs/development/libraries/attr/default.nix
+++ b/pkgs/development/libraries/attr/default.nix
@@ -49,6 +49,7 @@ stdenv.mkDerivation rec {
     platforms = lib.platforms.linux;
     badPlatforms = lib.platforms.microblaze;
     license = lib.licenses.gpl2Plus;
+    teams = [ lib.teams.security-review ];
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "attr_project" version;
   };
 }
diff --git a/pkgs/development/libraries/glibc/common.nix b/pkgs/development/libraries/glibc/common.nix
index 9b2946d019fb..6d26bffbd89c 100644
--- a/pkgs/development/libraries/glibc/common.nix
+++ b/pkgs/development/libraries/glibc/common.nix
@@ -352,6 +352,7 @@ stdenv.mkDerivation (
             ma27
             connorbaker
           ];
+          teams = [ lib.teams.security-review ];
           platforms = lib.platforms.linux;
         }
         // (args.meta or { });
diff --git a/pkgs/development/libraries/openssl/default.nix b/pkgs/development/libraries/openssl/default.nix
index f107a2242c07..3588178e5212 100644
--- a/pkgs/development/libraries/openssl/default.nix
+++ b/pkgs/development/libraries/openssl/default.nix
@@ -385,6 +385,7 @@ let
         license = lib.licenses.openssl;
         mainProgram = "openssl";
         maintainers = with lib.maintainers; [ thillux ];
+        teams = [ lib.teams.security-review ];
         pkgConfigModules = [
           "libcrypto"
           "libssl"
diff --git a/pkgs/development/libraries/sqlite/default.nix b/pkgs/development/libraries/sqlite/default.nix
index 9c6d4d86828d..f8722d6cd3d1 100644
--- a/pkgs/development/libraries/sqlite/default.nix
+++ b/pkgs/development/libraries/sqlite/default.nix
@@ -161,6 +161,7 @@ stdenv.mkDerivation rec {
     license = lib.licenses.publicDomain;
     mainProgram = "sqlite3";
     maintainers = with lib.maintainers; [ np ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.unix ++ lib.platforms.windows;
     pkgConfigModules = [ "sqlite3" ];
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "sqlite" version;
diff --git a/pkgs/development/libraries/zlib/default.nix b/pkgs/development/libraries/zlib/default.nix
index 72b0fcc207f7..0eece6c67075 100644
--- a/pkgs/development/libraries/zlib/default.nix
+++ b/pkgs/development/libraries/zlib/default.nix
@@ -173,6 +173,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.zlib;
     platforms = lib.platforms.all;
     pkgConfigModules = [ "zlib" ];
+    teams = [ lib.teams.security-review ];
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "zlib" finalAttrs.version;
   };
 })
diff --git a/pkgs/os-specific/linux/busybox/default.nix b/pkgs/os-specific/linux/busybox/default.nix
index e05c7cb756ad..8402337be16d 100644
--- a/pkgs/os-specific/linux/busybox/default.nix
+++ b/pkgs/os-specific/linux/busybox/default.nix
@@ -193,6 +193,7 @@ stdenv.mkDerivation rec {
       TethysSvensson
       qyliss
     ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.linux;
     priority = 15; # below systemd (halt, init, poweroff, reboot) and coreutils
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "busybox" version;
diff --git a/pkgs/os-specific/linux/iptables/default.nix b/pkgs/os-specific/linux/iptables/default.nix
index 6251fe9a8460..f357f950f315 100644
--- a/pkgs/os-specific/linux/iptables/default.nix
+++ b/pkgs/os-specific/linux/iptables/default.nix
@@ -170,6 +170,7 @@ stdenv.mkDerivation (finalAttrs: {
     platforms = lib.platforms.linux;
     mainProgram = "iptables";
     maintainers = with lib.maintainers; [ fpletz ];
+    teams = [ lib.teams.security-review ];
     license = lib.licenses.gpl2Plus;
     downloadPage = "https://www.netfilter.org/projects/iptables/files/";
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "netfilter" finalAttrs.version;
diff --git a/pkgs/os-specific/linux/kernel/build.nix b/pkgs/os-specific/linux/kernel/build.nix
index 90aa0c0b00c1..72e9bd7372fd 100644
--- a/pkgs/os-specific/linux/kernel/build.nix
+++ b/pkgs/os-specific/linux/kernel/build.nix
@@ -575,7 +575,10 @@ lib.makeOverridable (
       license = lib.licenses.gpl2Only;
       homepage = "https://www.kernel.org/";
       maintainers = [ maintainers.thoughtpolice ];
-      teams = [ teams.linux-kernel ];
+      teams = [
+        teams.linux-kernel
+        teams.security-review
+      ];
       platforms = platforms.linux;
       badPlatforms =
         lib.optionals (lib.versionOlder version "4.15") [
diff --git a/pkgs/os-specific/linux/kmod/default.nix b/pkgs/os-specific/linux/kmod/default.nix
index 795031af1a7f..7b8c795feeeb 100644
--- a/pkgs/os-specific/linux/kmod/default.nix
+++ b/pkgs/os-specific/linux/kmod/default.nix
@@ -141,6 +141,7 @@ stdenv.mkDerivation rec {
     ]; # GPLv2+ for tools
     platforms = lib.platforms.linux;
     maintainers = with lib.maintainers; [ artturin ];
+    teams = [ lib.teams.security-review ];
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "kernel" version;
   };
 }
diff --git a/pkgs/os-specific/linux/systemd/default.nix b/pkgs/os-specific/linux/systemd/default.nix
index 77d8b4666219..12a84fbab3b7 100644
--- a/pkgs/os-specific/linux/systemd/default.nix
+++ b/pkgs/os-specific/linux/systemd/default.nix
@@ -995,7 +995,10 @@ stdenv.mkDerivation (finalAttrs: {
       ofl
       publicDomain
     ];
-    teams = [ lib.teams.systemd ];
+    teams = [
+      lib.teams.systemd
+      lib.teams.security-review
+    ];
     pkgConfigModules = [
       "libsystemd"
       "libudev"
diff --git a/pkgs/shells/bash/5.nix b/pkgs/shells/bash/5.nix
index 86d3727cd94f..f4241a13ed41 100644
--- a/pkgs/shells/bash/5.nix
+++ b/pkgs/shells/bash/5.nix
@@ -283,6 +283,7 @@ lib.warnIf (withDocs != null)
       # https://github.com/NixOS/nixpkgs/issues/333338
       badPlatforms = [ lib.systems.inspect.patterns.isMinGW ];
       maintainers = with lib.maintainers; [ infinisil ];
+      teams = [ lib.teams.security-review ];
       mainProgram = "bash";
       identifiers.cpeParts =
         let
diff --git a/pkgs/tools/misc/coreutils/default.nix b/pkgs/tools/misc/coreutils/default.nix
index c09bc4ff35d0..c82374c08506 100644
--- a/pkgs/tools/misc/coreutils/default.nix
+++ b/pkgs/tools/misc/coreutils/default.nix
@@ -266,6 +266,7 @@ stdenv.mkDerivation (finalAttrs: {
       das_j
       mdaniels5757
     ];
+    teams = [ lib.teams.security-review ];
     platforms = with lib.platforms; unix ++ windows;
     priority = 10;
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
diff --git a/pkgs/tools/misc/findutils/default.nix b/pkgs/tools/misc/findutils/default.nix
index 569877e9c994..4e3ab7d19dd9 100644
--- a/pkgs/tools/misc/findutils/default.nix
+++ b/pkgs/tools/misc/findutils/default.nix
@@ -106,6 +106,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.gpl3Plus;
     mainProgram = "find";
     maintainers = [ lib.maintainers.mdaniels5757 ];
+    teams = [ lib.teams.security-review ];
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" finalAttrs.version;
   };
 })
diff --git a/pkgs/tools/networking/openssh/common.nix b/pkgs/tools/networking/openssh/common.nix
index ce0145524812..fc59d8773bdd 100644
--- a/pkgs/tools/networking/openssh/common.nix
+++ b/pkgs/tools/networking/openssh/common.nix
@@ -311,6 +311,7 @@ stdenv.mkDerivation (finalAttrs: {
     license = lib.licenses.bsd2;
     platforms = lib.platforms.unix ++ lib.platforms.windows;
     maintainers = extraMeta.maintainers or [ ];
+    teams = [ lib.teams.security-review ];
     mainProgram = "ssh";
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "openbsd" finalAttrs.version;
   }
diff --git a/pkgs/tools/package-management/nix/default.nix b/pkgs/tools/package-management/nix/default.nix
index 2db1321747df..122a24519aa9 100644
--- a/pkgs/tools/package-management/nix/default.nix
+++ b/pkgs/tools/package-management/nix/default.nix
@@ -120,7 +120,10 @@ let
       nixComponentsAttributeName
     ];
 
-  teams = [ lib.teams.nix ];
+  teams = [
+    lib.teams.nix
+    lib.teams.security-review
+  ];
 
   # Disables tests that have been flaky due to the darwin sandbox and fork safety
   # with missing shebangs.
diff --git a/pkgs/tools/security/gnupg/24.nix b/pkgs/tools/security/gnupg/24.nix
index 706457e66f8a..b71a8c66066a 100644
--- a/pkgs/tools/security/gnupg/24.nix
+++ b/pkgs/tools/security/gnupg/24.nix
@@ -217,6 +217,7 @@ stdenv.mkDerivation rec {
       fpletz
       sgo
     ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     mainProgram = "gpg";
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnupg" version;
diff --git a/pkgs/tools/text/gnugrep/default.nix b/pkgs/tools/text/gnugrep/default.nix
index c353e1cd938d..9f0ecedd8792 100644
--- a/pkgs/tools/text/gnugrep/default.nix
+++ b/pkgs/tools/text/gnugrep/default.nix
@@ -113,6 +113,7 @@ stdenv.mkDerivation {
       lib.maintainers.das_j
       lib.maintainers.m00wl
     ];
+    teams = [ lib.teams.security-review ];
     platforms = lib.platforms.all;
     mainProgram = "grep";
     identifiers.cpeParts = lib.meta.cpeFullVersionWithVendor "gnu" version // {