diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 2c48c8b..f95d8a5 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -5,7 +5,15 @@
 
 version: 2
 updates:
-  - package-ecosystem: "github-actions"
-    directory: "/"
+  - package-ecosystem: pip
+    directory: /
     schedule:
-      interval: "daily"
+      interval: weekly
+    labels:
+      - bumpless
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - bumpless
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 9b22b22..dc7fdf3 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -3,13 +3,15 @@ name: Static code analysis
 on: push
 
 jobs:
-
   cfn-lint:
     runs-on: ubuntu-latest
-
     steps:
       - uses: actions/checkout@v4
-
-      - uses: scottbrenner/cfn-lint-action@v2.3.7
+      - uses: actions/setup-python@v5
         with:
-          args: "--template cloudformation.yml"
+          python-version: 3.9
+      - run: |
+          python -m pip install --upgrade pip
+          python -m pip install -r requirements.txt
+      - run: |
+          cfn-lint --info --template cloudformation.yml
diff --git a/cloudformation.yml b/cloudformation.yml
index 874375d..08544f6 100644
--- a/cloudformation.yml
+++ b/cloudformation.yml
@@ -6,12 +6,37 @@ Resources:
     Type: AWS::S3::Bucket
     Properties:
       BucketName: !Sub "${AWS::StackName}-logs"
-      AccessControl: LogDeliveryWrite
       PublicAccessBlockConfiguration:
         BlockPublicAcls: True
         IgnorePublicAcls: True
         BlockPublicPolicy: True
         RestrictPublicBuckets: True
+      BucketEncryption:
+        ServerSideEncryptionConfiguration:
+          - ServerSideEncryptionByDefault:
+              SSEAlgorithm: AES256
+            BucketKeyEnabled: true
+      OwnershipControls:
+        Rules:
+          - ObjectOwnership: BucketOwnerEnforced
+
+  LogBucketPolicy:
+    Type: AWS::S3::BucketPolicy
+    Properties:
+      Bucket: !Ref LogBucket
+      PolicyDocument:
+        Version: 2012-10-17
+        Statement:
+          - Effect: Allow
+            Principal:
+              Service: logging.s3.amazonaws.com
+            Action: s3:PutObject
+            Resource: !Sub "${LogBucket.Arn}/*"
+            Condition:
+              ArnLike:
+                "aws:SourceArn": !GetAtt ContentBucket.Arn
+              StringEquals:
+                "aws:SourceAccount": !Ref AWS::AccountId
 
   ContentBucket:
     Type: AWS::S3::Bucket
@@ -32,6 +57,9 @@ Resources:
         IgnorePublicAcls: True
         BlockPublicPolicy: False
         RestrictPublicBuckets: False
+      OwnershipControls:
+        Rules:
+          - ObjectOwnership: BucketOwnerEnforced
 
   BucketPolicy:
     Type: AWS::S3::BucketPolicy
diff --git a/requirements.txt b/requirements.txt
new file mode 100644
index 0000000..08b965e
--- /dev/null
+++ b/requirements.txt
@@ -0,0 +1 @@
+cfn-lint==1.4.2