A discussion between two experienced software engineers on integrating security and compliance into deployment pipelines. Drawing on real-world examples from Siemens Healthcare, large investment banks, and LMAX exchange, they argue that continuous delivery and regulatory compliance are not adversarial but deeply aligned. Key insights include: compliance requirements are often sensible guardrails that map well to good engineering practices; automating compliance as part of the pipeline (continuous compliance) produces more reliable audit trails than manual processes; generating release documentation as a build artifact ensures accuracy; and security should be approached through 'securability' — designing small, well-defined components with minimal attack surfaces. Penetration testing findings should be automated into the pipeline so the same vulnerability is never found twice.