diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..a4fd5b7
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "27 4 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (Go)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-go@v6
+        with:
+          go-version: stable
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: go
+          build-mode: manual
+      - name: Build
+        run: go build ./...
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: "/language:go"
diff --git a/README.md b/README.md
index adbe979..c3db86f 100644
--- a/README.md
+++ b/README.md
@@ -3,8 +3,11 @@
 Drive your **real, already-running Chrome** — your actual tabs, logins, cookies, and extensions — from the command line.
 Built for humans and AI agents alike: every command speaks one JSON envelope and one stable exit-code contract.
 
-[![CI](https://github.com/sanketsudake/chrome-cdp-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/sanketsudake/chrome-cdp-cli/actions/workflows/ci.yml) [![Go Reference](https://pkg.go.dev/badge/github.com/sanketsudake/chrome-cdp-cli.svg)](https://pkg.go.dev/github.com/sanketsudake/chrome-cdp-cli) [![Go Report Card](https://goreportcard.com/badge/github.com/sanketsudake/chrome-cdp-cli)](https://goreportcard.com/report/github.com/sanketsudake/chrome-cdp-cli)
-[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Go Reference](https://pkg.go.dev/badge/github.com/sanketsudake/chrome-cdp-cli.svg)](https://pkg.go.dev/github.com/sanketsudake/chrome-cdp-cli)
+[![CI](https://github.com/sanketsudake/chrome-cdp-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/sanketsudake/chrome-cdp-cli/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/sanketsudake/chrome-cdp-cli/actions/workflows/codeql.yml/badge.svg)](https://github.com/sanketsudake/chrome-cdp-cli/actions/workflows/codeql.yml)
+[![License](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
+[![Go Version](https://img.shields.io/github/go-mod/go-version/sanketsudake/chrome-cdp-cli)](go.mod)
 
 ```sh
 chrome-cdp open https://example.com     # open a tab, get its id