diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..e1533192
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,11 @@
+# CodeQL configuration for the advanced setup in .github/workflows/codeql.yml.
+#
+# tests/ is excluded from analysis. Test contracts deliberately carry
+# credential-shaped field names and fake secrets (to prove they are refused
+# and never quoted), and CodeQL's sensitive-data heuristics treat them as
+# taint sources for alerts in production code (PR #712: alerts 308 and 310
+# were dismissed as false positives for exactly this). Production code is
+# still analysed in full, and is the only place a real secret can enter.
+name: forge-cli CodeQL
+paths-ignore:
+  - tests/**
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..7a7e63a5
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,49 @@
+# CodeQL advanced setup. It replaces GitHub's default setup (same languages)
+# so .github/codeql/codeql-config.yml can keep the test suite out of the
+# analysis, and it runs the security-extended suite: the default suite plus
+# lower-precision security queries. The default setup must stay off in the
+# repository's code-security settings, or GitHub refuses this workflow's
+# uploads.
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 4 * * 1"
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [actions, javascript-typescript, python]
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-extended
+          config-file: ./.github/codeql/codeql-config.yml
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
+        with:
+          category: "/language:${{ matrix.language }}"