diff --git a/.github/lsan-suppressions.txt b/.github/lsan-suppressions.txt
new file mode 100644
index 0000000..8eb2276
--- /dev/null
+++ b/.github/lsan-suppressions.txt
@@ -0,0 +1,3 @@
+# Leaks reported inside the uninstrumented OpenCL CPU runtime
+# leak:libOpenCL.so
+# leak:libur_adapter_opencl.so
diff --git a/.github/workflows/basic.yml b/.github/workflows/basic.yml
index 8edd61f..acde228 100644
--- a/.github/workflows/basic.yml
+++ b/.github/workflows/basic.yml
@@ -86,6 +86,38 @@ jobs:
         name: documentation
         path: target/doc
 
+  sanitizers:
+    if: github.event_name != 'schedule'
+    runs-on: ["oneapi-rs", "Linux"]
+
+    steps:
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+    - name: Setup oneAPI
+      uses: ./.github/actions/setup-oneapi
+
+    - name: Install nightly toolchain
+      run: rustup toolchain install nightly --profile minimal
+
+    - name: Build and test with hardening flags
+      env:
+        RUSTFLAGS: -Zemit-stack-sizes -Zcf-protection=full
+        CARGO_TARGET_DIR: target/hardened
+      run: |
+        cargo +nightly test --workspace --verbose
+        cargo +nightly build --workspace --release --verbose
+
+    - name: Run tests with sanitizers
+      env:
+        # Test only CPU to avoid issues with GPU drivers and sanitizers
+        ONEAPI_DEVICE_SELECTOR: opencl:cpu
+        LSAN_OPTIONS: suppressions=${{ github.workspace }}/.github/lsan-suppressions.txt
+      run: |
+        for sanitizer in address leak thread; do
+          RUSTFLAGS="-Zsanitizer=$sanitizer" CARGO_TARGET_DIR="target/sanitizer-$sanitizer" \
+            cargo +nightly test --workspace --lib --tests --target x86_64-unknown-linux-gnu --verbose
+        done
+
   trivy:
     name: Trivy scan
     runs-on: ubuntu-latest
@@ -149,7 +181,11 @@ jobs:
     - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
     - name: Audit dependencies against RustSec
-      run: cargo +stable audit --deny unsound --format sarif > cargo-audit.sarif
+      run: |
+        database_dir="$(mktemp -d "$RUNNER_TEMP/rustsec.XXXXXX")"
+        cargo +stable audit --deny unsound --format sarif \
+          --db "$database_dir/advisory-db" \
+          --url https://github.com/RustSec/advisory-db.git > cargo-audit.sarif
 
     - name: Upload RustSec findings
       # Upload the report even when the audit step fails on findings.