diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
new file mode 100644
index 0000000..8aad74c
--- /dev/null
+++ b/.github/workflows/sonar.yml
@@ -0,0 +1,31 @@
+name: SonarQube
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: sonar-${{ github.event_name }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+jobs:
+  analysis:
+    name: SonarQube analysis
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          args: -Dsonar.qualitygate.wait=true -Dsonar.qualitygate.timeout=300
diff --git a/README.md b/README.md
index b718212..ac72cb6 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # Durable Workflow CLI
 
+[![Quality Gate](https://sonarcloud.io/api/project_badges/measure?project=durable-workflow_cli&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=durable-workflow_cli)
+
 <p align="center">
   <a href="https://github.com/durable-workflow/cli/actions/workflows/build.yml?query=branch%3Amain"><img src="https://github.com/durable-workflow/cli/actions/workflows/build.yml/badge.svg?branch=main" alt="Build status"></a>
   <a href="https://github.com/durable-workflow/cli/releases/latest"><img src="https://img.shields.io/github/v/release/durable-workflow/cli?sort=semver" alt="Latest release"></a>
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..4762d37
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,14 @@
+sonar.organization=durable-workflow
+sonar.projectKey=durable-workflow_cli
+sonar.projectName=cli
+sonar.sourceEncoding=UTF-8
+sonar.sources=.
+sonar.tests=.
+sonar.test.inclusions=tests/**,**/tests/**,**/*.test.*,**/*.spec.*,**/test_*.py,benchmarks/**,scripts/conformance/**
+# Dependencies, generated assets and disposable runtime/build output are not source.
+sonar.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/dist/**,**/build/**,**/storage/**,**/.venv/**,**/__pycache__/**,**/coverage/**,**/.scannerwork/**,**/.git/**,static/vendor/**,public/vendor/**,resources/js/vendor/**
+sonar.test.exclusions=**/vendor/**,**/node_modules/**,**/target/**,**/.venv/**
+# This CI job performs static analysis. Repository test/coverage gates stay required.
+# No coverage report is collected here; leave that metric unmeasured in Sonar.
+sonar.coverage.exclusions=**/*
+sonar.sca.enabled=false