diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
new file mode 100644
index 0000000..62fd13a
--- /dev/null
+++ b/.github/workflows/codeql.yaml
@@ -0,0 +1,21 @@
+name: 🛡️ CodeQL
+on:
+  workflow_dispatch:
+  push:
+    branches: ["main"]
+  pull_request:
+  schedule:
+    - cron: "12 9 * * 2"
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analyze:
+    name: 🛡️ Analyze
+    uses: tox-dev/github-workflows/.github/workflows/codeql.yaml@7f521def2d390ad786d8d29a28f1bc56dad0cde9 # 6.5.6
+    permissions:
+      contents: read
+      security-events: write
+    with:
+      languages: '["actions"]'