diff --git a/.github/workflows/backport.yaml b/.github/workflows/backport.yaml
index a94bf5e..c17597d 100644
--- a/.github/workflows/backport.yaml
+++ b/.github/workflows/backport.yaml
@@ -7,6 +7,6 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.3
+    uses: fluxcd/gha-workflows/.github/workflows/backport.yaml@v0.0.4
     secrets:
       github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/code-scan.yaml b/.github/workflows/code-scan.yaml
new file mode 100644
index 0000000..06dbe38
--- /dev/null
+++ b/.github/workflows/code-scan.yaml
@@ -0,0 +1,15 @@
+name: code-scan
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+jobs:
+  analyze:
+    permissions:
+      contents: read
+      security-events: write
+    uses: fluxcd/gha-workflows/.github/workflows/code-scan.yaml@v0.0.4
+    secrets:
+      github-token: ${{ secrets.GITHUB_TOKEN }}
+      fossa-token: ${{ secrets.FOSSA_TOKEN }}
diff --git a/.github/workflows/labels-sync.yaml b/.github/workflows/labels-sync.yaml
index db2402c..ecb0bb3 100644
--- a/.github/workflows/labels-sync.yaml
+++ b/.github/workflows/labels-sync.yaml
@@ -11,4 +11,4 @@ jobs:
     permissions:
       issues: write
       contents: read
-    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.1
+    uses: fluxcd/gha-workflows/.github/workflows/labels-sync.yaml@v0.0.4
diff --git a/README.md b/README.md
index f011295..bcb19bb 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,6 @@
 # source-watcher
 
+[![fossa](https://app.fossa.com/api/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher.svg?type=small)](https://app.fossa.com/projects/custom%2B162%2Fgithub.com%2Ffluxcd%2Fsource-watcher?ref=badge_small)
 [![test](https://github.com/fluxcd/source-watcher/workflows/e2e/badge.svg)](https://github.com/fluxcd/source-watcher/actions)
 [![report](https://goreportcard.com/badge/github.com/fluxcd/source-watcher)](https://goreportcard.com/report/github.com/fluxcd/source-watcher)
 [![license](https://img.shields.io/github/license/fluxcd/source-watcher.svg)](https://github.com/fluxcd/source-watcher/blob/main/LICENSE)