diff --git a/.tool-versions b/.tool-versions
index 9e0a9cad02..ecdbb5348c 100755
--- a/.tool-versions
+++ b/.tool-versions
@@ -1,2 +1,2 @@
 erlang 25.2
-elixir 1.14.2-otp-25
+elixir 1.14.3-otp-25
diff --git a/justfile b/justfile
index afb9b73ac0..763f7177ae 100644
--- a/justfile
+++ b/justfile
@@ -631,6 +631,9 @@ licenses:
 	@mkdir -p docs/DEPENDENCIES/
 	just mix-remote licenses && mv DEPENDENCIES.md docs/DEPENDENCIES/$FLAVOUR.md
 
+audit:
+	AS_UMBRELLA=1 just mix sobelow
+
 # Extract strings to-be-localised from the app and installed extensions
 # FIXME: should extract to root app, not activity_pub like it's doing (for whatever reason)
 localise-extract: 
diff --git a/mix.exs b/mix.exs
index 785ae95eda..bb29f33b0b 100755
--- a/mix.exs
+++ b/mix.exs
@@ -318,7 +318,8 @@ defmodule Bonfire.Umbrella.MixProject do
       "ecto.setup": ["ecto.create", "ecto.migrate"],
       "ecto.migrate": ["bonfire.seeds"],
       "ecto.reset": ["ecto.drop --force", "ecto.setup"],
-      test: ["ecto.create --quiet", "ecto.migrate --quiet", "test"]
+      test: ["ecto.create --quiet", "ecto.migrate --quiet", "test"],
+      sobelow: ["cmd mix sobelow"]
     ]
   end
 end