diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
new file mode 100644
index 0000000..cd066d3
--- /dev/null
+++ b/.github/workflows/codeql.yaml
@@ -0,0 +1,36 @@
+name: CodeQL
+permissions: read-all
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+      - devs/**
+  schedule:
+    - cron: 41 4 * * 1
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  # The repository's code is action.yml and the workflows; the actions
+  # language covers both, including the composite action's shell step.
+  analyze:
+    timeout-minutes: 10
+    runs-on: ubuntu-26.04
+    permissions:
+      security-events: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          languages: actions
+
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
new file mode 100644
index 0000000..4827a2b
--- /dev/null
+++ b/.github/workflows/scorecard.yaml
@@ -0,0 +1,42 @@
+name: Scorecard
+permissions: read-all
+
+on:
+  push:
+    branches:
+      - main
+  schedule:
+    - cron: 17 4 * * 1
+  branch_protection_rule:
+
+# Results are published to api.securityscorecards.dev, which only accepts
+# them from a workflow that follows its restrictions:
+# https://github.com/ossf/scorecard-action#workflow-restrictions
+jobs:
+  analysis:
+    # The API rejects runner labels it does not know, and its list stops
+    # short of ubuntu-26.04.
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      id-token: write
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+        with:
+          persist-credentials: false
+
+      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        with:
+          results_file: results.sarif
+          results_format: sarif
+          publish_results: true
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
+        with:
+          name: scorecard-results
+          path: results.sarif
+          retention-days: 5
+
+      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          sarif_file: results.sarif
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..34448d2
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,29 @@
+# Security Policy
+
+This policy covers the `Mergifyio/setup-cli` GitHub Action published in this
+repository. The CLI it installs and the installer it runs (`install.sh`) live
+in [Mergifyio/mergify-cli](https://github.com/Mergifyio/mergify-cli), which
+has its own policy; reports for either go to the same place.
+
+## Reporting a vulnerability
+
+Please do not report security vulnerabilities through public GitHub issues,
+discussions or pull requests.
+
+Report them privately through Mergify's bug bounty program on HackerOne:
+<https://hackerone.com/mergify>. For other security questions, write to
+<security@mergify.com>.
+
+A useful report says which version of the action you used (the `uses:` line
+of your workflow), how to reproduce the issue and what an attacker gains
+from it.
+
+Mergify's vulnerability disclosure policy is published at
+<https://docs.mergify.com/security/#vulnerability-disclosure>.
+
+## Supported versions
+
+Security fixes ship in a new `vX.Y.Z` release of the action, and the major
+tag (`v1`) moves to it. Workflows that use `Mergifyio/setup-cli@v1` pick the
+fix up on their next run; workflows pinned to a full version or a commit SHA
+need to bump it.