diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml
new file mode 100644
index 0000000000..0454b6dafd
--- /dev/null
+++ b/.github/workflows/plumber.yml
@@ -0,0 +1,36 @@
+name: Plumber
+
+on:
+  push:
+    branches: [dev, master]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  plumber:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+      # Needed by score-push to publish the score for the README badge.
+      id-token: write
+    steps:
+      - name: checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: run plumber
+        uses: getplumber/plumber@40bd6b5bb8ff4f0944feacaeb41dea6bce08d62d # v0.4.28
+        with:
+          # Code scanning upload needs security-events write, which PRs
+          # from forks do not get. The report stays available as a
+          # workflow artifact there.
+          upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }}
+          # Publishes the score to score.getplumber.io, which feeds the
+          # badge in the README. A failed push never fails the run.
+          score-push: true
+          # Gate at 85 points instead of the all-or-nothing default,
+          # leaves room for a small finding without blocking PRs.
+          min-points: 85
diff --git a/.plumber.yaml b/.plumber.yaml
new file mode 100644
index 0000000000..acede2fcee
--- /dev/null
+++ b/.plumber.yaml
@@ -0,0 +1,20 @@
+# Plumber overlay: inherits every control from the CLI's built-in
+# baseline, only the differences for this repo are written here.
+# Run 'plumber config resolve' to see the full effective config.
+extends: plumber:default
+version: "2.0"
+
+github:
+  controls:
+    githubActionMustComeFromAuthorizedSources:
+      # Keep the curated default list and trust the niche platform
+      # actions this repo already relies on for its BSD, Solaris and
+      # arch-emulation builds, plus the release helpers.
+      includePlumberDefaults: true
+      trustedGithubActions:
+        - cross-platform-actions/action
+        - jirutka/setup-alpine
+        - ncipollo/release-action
+        - pozetroninc/github-action-get-latest-release
+        - uraimo/run-on-arch-action
+        - vmactions/solaris-vm
diff --git a/README.md b/README.md
index d2b0a53d92..c39f7f6a98 100644
--- a/README.md
+++ b/README.md
@@ -10,6 +10,7 @@
 [![GitHub release (with filter)](https://img.shields.io/github/v/release/fastfetch-cli/fastfetch?logo=github)](https://github.com/fastfetch-cli/fastfetch/releases)
 [![latest packaged version(s)](https://repology.org/badge/latest-versions/fastfetch.svg)](https://repology.org/project/fastfetch/versions)
 [![Packaging status](https://repology.org/badge/tiny-repos/fastfetch.svg)](https://repology.org/project/fastfetch/versions)
+[![Plumber Score](https://score.getplumber.io/github.com/fastfetch-cli/fastfetch.svg)](https://score.getplumber.io/github.com/fastfetch-cli/fastfetch)
 [![Ask DeepWiki](https://deepwiki.com/badge.svg)](https://deepwiki.com/fastfetch-cli/fastfetch)
 [![中文README](https://img.shields.io/badge/%E4%B8%AD%E6%96%87-README-red)](README-cn.md)