diff --git a/.fallowrc.json b/.fallowrc.json
new file mode 100644
index 0000000..3b239a9
--- /dev/null
+++ b/.fallowrc.json
@@ -0,0 +1,18 @@
+{
+  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/main/schema.json",
+  "duplicates": {
+    "ignore": [
+      "packages/**/*.test.ts",
+      "packages/**/*.spec.ts",
+      "packages/**/*.e2e.test.ts"
+    ],
+    "ignoreImports": true
+  },
+  "health": {
+    "ignore": [
+      "packages/**/*.test.ts",
+      "packages/**/*.spec.ts",
+      "packages/**/*.e2e.test.ts"
+    ]
+  }
+}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f63a140..0e16c45 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,6 +19,17 @@ jobs:
       - name: Verify lockfile unchanged
         run: git diff --exit-code bun.lock
 
+      - name: Fallow analysis
+        uses: fallow-rs/fallow@v2
+        with:
+          format: sarif
+          fail-on-issues: false
+
+      - name: Upload Fallow SARIF
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: fallow-results.sarif
+
       - name: Verify
         env:
           TURBO_TOKEN: ${{ secrets.TURBO_TOKEN }}
diff --git a/fallow-plugin-chkit-conventions.jsonc b/fallow-plugin-chkit-conventions.jsonc
new file mode 100644
index 0000000..f0c217a
--- /dev/null
+++ b/fallow-plugin-chkit-conventions.jsonc
@@ -0,0 +1,23 @@
+{
+  "$schema": "https://raw.githubusercontent.com/fallow-rs/fallow/main/plugin-schema.json",
+  "name": "chkit-conventions",
+  "detection": { "type": "fileExists", "pattern": "bun.lock" },
+  "entryPointRole": "test",
+  "entryPoints": [
+    "packages/**/*.test.ts",
+    "packages/**/*.spec.ts",
+    "packages/**/*.e2e.test.ts"
+  ],
+  "alwaysUsed": [
+    "apps/docs/functions/**/*.ts",
+    "apps/docs/src/styles/custom.css",
+    "packages/cli/src/e2e-testkit.ts"
+  ],
+  "configPatterns": [
+    "apps/docs/astro.config.mjs",
+    "apps/docs/wrangler.jsonc",
+    "biome.json",
+    "turbo.json"
+  ],
+  "toolingDependencies": ["sharp", "wrangler"]
+}
diff --git a/package.json b/package.json
index d51b17f..62e4a8b 100644
--- a/package.json
+++ b/package.json
@@ -25,6 +25,10 @@
     "test": "turbo run test",
     "test:turbo": "turbo run test",
     "test:env": "doppler run --project chkit --config ci -- bun run test",
+    "fallow": "bunx fallow",
+    "fallow:dead-code": "bunx fallow --only dead-code",
+    "fallow:pr": "bunx fallow --changed-since main --summary || true",
+    "fallow:ci": "bunx fallow --fail-on-issues",
     "verify": "doppler run --project chkit --config ci -- turbo run typecheck lint test build",
     "changeset": "changeset",
     "version-packages": "changeset version",
diff --git a/packages/cli/src/bin/clickhouse-resource.ts b/packages/cli/src/bin/clickhouse-resource.ts
deleted file mode 100644
index 476e8ab..0000000
--- a/packages/cli/src/bin/clickhouse-resource.ts
+++ /dev/null
@@ -1,14 +0,0 @@
-import { createClickHouseExecutor, type ClickHouseExecutor } from '@chkit/clickhouse'
-import type { ChxConfig } from '@chkit/core'
-
-export async function withClickHouseExecutor<T>(
-  clickhouseConfig: NonNullable<ChxConfig['clickhouse']>,
-  run: (db: ClickHouseExecutor) => Promise<T>
-): Promise<T> {
-  const db = createClickHouseExecutor(clickhouseConfig)
-  try {
-    return await run(db)
-  } finally {
-    await db.close()
-  }
-}
diff --git a/src/db/schema/example.ts b/src/db/schema/example.ts
deleted file mode 100644
index 31ec209..0000000
--- a/src/db/schema/example.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-import { schema, table } from '@chkit/core'
-
-const events = table({
-  database: 'default',
-  name: 'events',
-  engine: 'MergeTree',
-  columns: [
-    { name: 'id', type: 'UInt64' },
-    { name: 'source', type: 'String' },
-    { name: 'ingested_at', type: 'DateTime64(3)', default: 'fn:now64(3)' },
-  ],
-  primaryKey: ['id'],
-  orderBy: ['id'],
-  partitionBy: 'toYYYYMM(ingested_at)',
-})
-
-export default schema(events)