diff --git a/.github/workflows/ci_check_license_headers.yaml b/.github/workflows/ci_check_license_headers.yaml
index b667267..571efd4 100644
--- a/.github/workflows/ci_check_license_headers.yaml
+++ b/.github/workflows/ci_check_license_headers.yaml
@@ -23,6 +23,9 @@ on:
     branches: ["**"]
     types: [opened, reopened, ready_for_review, synchronize]
 
+permissions:
+  contents: read
+
 env:
   APACHE_RAT_VERSION: 0.17
 
diff --git a/.github/workflows/ci_codeql.yml b/.github/workflows/ci_codeql.yml
new file mode 100644
index 0000000..d81fa8b
--- /dev/null
+++ b/.github/workflows/ci_codeql.yml
@@ -0,0 +1,54 @@
+#
+# Copyright 2021-Present The Serverless Workflow Specification Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: "CI :: CodeQL"
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    # Run weekly on Monday at 12:00 UTC.
+    - cron: "0 12 * * 1"
+
+permissions:
+  actions: read
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+
+    strategy:
+      fail-fast: false
+      matrix:
+        language: ["javascript-typescript", "actions"]
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          queries: security-extended
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v4
diff --git a/.github/workflows/sync-issues-to-project.yml b/.github/workflows/sync-issues-to-project.yml
index e1f3894..b6dcfd8 100644
--- a/.github/workflows/sync-issues-to-project.yml
+++ b/.github/workflows/sync-issues-to-project.yml
@@ -21,6 +21,9 @@ on:
     types: [opened, closed]
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   sync:
     runs-on: ubuntu-latest