diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..922c581
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,35 @@
+name: CodeQL
+
+on:
+    push:
+        branches: [main]
+    pull_request:
+        branches: [main]
+    schedule:
+        - cron: '30 1 * * 1'
+
+permissions: read-all
+
+jobs:
+    analyze:
+        name: Analyze (javascript-typescript)
+        runs-on: ubuntu-24.04
+        permissions:
+            contents: read
+            security-events: write
+        steps:
+            - name: Checkout
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+            - name: Initialize CodeQL
+              # github/codeql-action v3.28.13
+              uses: github/codeql-action/init@458d36d7d4f47d0dd16ca424c1d3cda0060f1360
+              with:
+                  languages: javascript-typescript
+                  queries: security-extended
+
+            - name: Analyze
+              # github/codeql-action v3.28.13
+              uses: github/codeql-action/analyze@458d36d7d4f47d0dd16ca424c1d3cda0060f1360
+              with:
+                  category: /language:javascript-typescript
diff --git a/SECURITY.md b/SECURITY.md
index c8ac136..6dd05c7 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -100,6 +100,10 @@ All commits to this repository are signed with an SSH key managed by 1Password.
 
 Git is configured globally with `gpg.format = ssh` and `commit.gpgsign = true`, so signing is automatic and does not require per-commit flags. The private key never leaves 1Password; signing requests are handled by the 1Password SSH agent.
 
+### CodeQL
+
+A CodeQL workflow runs on every push and pull request to `main`, and weekly on Mondays. It uses the `security-extended` query suite for JavaScript/TypeScript, which covers OWASP Top 10 and additional security patterns beyond the default set. Results are uploaded to GitHub's code scanning dashboard as SARIF findings. The action is SHA-pinned to v3.
+
 ### OSSF Scorecard
 
 A [Scorecard](https://securityscorecards.dev) workflow runs weekly and on every push to `main`. It evaluates supply-chain security practices (pinned dependencies, branch protection, token permissions, code review, vulnerability disclosure) and publishes results to the GitHub code scanning dashboard. Results are also published publicly to the OSSF scorecard index.