diff --git a/ARCHITECTURE.md b/ARCHITECTURE.md
index 598ffd8..a3587d3 100644
--- a/ARCHITECTURE.md
+++ b/ARCHITECTURE.md
@@ -359,7 +359,9 @@ Coverage counts only what `go test` runs in-process. The end-to-end tests run th
 they prove behavior but are not counted: `cmd/gitwhy` and `internal/ui` show 0%. Every third-party
 action is pinned to a full commit SHA and every tool to an exact version; Dependabot proposes the
 updates. `.github/workflows/check-secrets.yml` (manual) checks that the release secrets are set and
-that the Homebrew token can write to the tap.
+that the Homebrew token can write to the tap. GitHub code scanning (CodeQL default setup, managed
+in the repository settings, so there is no workflow file) analyzes the Go code, the workflows, the
+npm package and the Python scripts on every push and pull request to `main` and once a week.
 
 ## Build, release and packaging
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c82f768..aba934d 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -36,7 +36,8 @@ node --test npm/lib.test.js         # the npm package
 CI (`.github/workflows/ci.yml`) is the authority. On top of the commands above it runs `govulncheck`,
 `actionlint`, `shellcheck`, checks that `go.mod`/`go.sum` are tidy and that `THIRD_PARTY_LICENSES` is up
 to date (`scripts/third-party-licenses.sh` regenerates it), builds every release artifact with goreleaser
-in snapshot mode, and builds the Nix flake. All of it must be green before a merge.
+in snapshot mode, and builds the Nix flake. GitHub code scanning (CodeQL) also runs on every pull
+request. All of it must be green before a merge.
 
 ### Coverage
 
diff --git a/README.md b/README.md
index 1db139a..231b05e 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,7 @@
 
 [![ci](https://github.com/dpologdvinity/gitwhy/actions/workflows/ci.yml/badge.svg)](https://github.com/dpologdvinity/gitwhy/actions/workflows/ci.yml)
 [![release installs verified](https://github.com/dpologdvinity/gitwhy/actions/workflows/verify-install.yml/badge.svg)](https://github.com/dpologdvinity/gitwhy/actions/workflows/verify-install.yml)
+[![CodeQL](https://github.com/dpologdvinity/gitwhy/actions/workflows/github-code-scanning/codeql/badge.svg)](https://github.com/dpologdvinity/gitwhy/security/code-scanning)
 [![latest release](https://img.shields.io/github/v/release/dpologdvinity/gitwhy)](https://github.com/dpologdvinity/gitwhy/releases/latest)
 [![npm](https://img.shields.io/npm/v/@kaitlynbassford/gitwhy)](https://www.npmjs.com/package/@kaitlynbassford/gitwhy)
 [![downloads](https://img.shields.io/github/downloads/dpologdvinity/gitwhy/total)](https://github.com/dpologdvinity/gitwhy/releases)