diff --git a/.github/codeql/README.md b/.github/codeql/README.md
new file mode 100644
index 00000000..7bb9c880
--- /dev/null
+++ b/.github/codeql/README.md
@@ -0,0 +1,9 @@
+# Security analysis
+
+The CodeQL workflow runs the `security-extended` query suite for the SDK language and GitHub Actions on pull requests, pushes, merge queues and a weekly schedule. It can also be started manually.
+
+The SDK scan includes sync/async clients, examples, release scripts and package setup. Generated protobuf stubs and test fixtures are excluded.
+
+Results are published to **Security and quality → Code scanning**, with a separate category for each language. Review initial findings and record a reason for every dismissed alert.
+
+After merging, require both **CodeQL (python)** and **CodeQL (actions)** job checks for supported branches. Also enable **Require code scanning results → CodeQL → Security alerts: High or higher** in the branch ruleset. Successful workflow execution alone does not enforce this threshold. Track the latest analysis commit/date, extraction errors and open findings by security severity.
diff --git a/.github/codeql/actions.yml b/.github/codeql/actions.yml
new file mode 100644
index 00000000..57959b9d
--- /dev/null
+++ b/.github/codeql/actions.yml
@@ -0,0 +1,4 @@
+name: GitHub Actions security baseline
+
+queries:
+  - uses: security-extended
diff --git a/.github/codeql/sdk.yml b/.github/codeql/sdk.yml
new file mode 100644
index 00000000..d5a283af
--- /dev/null
+++ b/.github/codeql/sdk.yml
@@ -0,0 +1,9 @@
+name: SDK security baseline
+
+queries:
+  - uses: security-extended
+
+paths-ignore:
+  - "ydb/_grpc/**"
+  - "tests/**"
+  - "**/*_test.py"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..ed1ed712
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,52 @@
+name: CodeQL
+
+on:
+  push:
+    branches: ["main"]
+  pull_request:
+    branches: ["main"]
+  merge_group:
+  schedule:
+    - cron: '23 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    name: CodeQL (${{ matrix.language }})
+    runs-on: ubuntu-24.04
+    timeout-minutes: 45
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - language: python
+            build-mode: none
+            config: .github/codeql/sdk.yml
+          - language: actions
+            build-mode: none
+            config: .github/codeql/actions.yml
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: ${{ matrix.build-mode }}
+          config-file: ${{ matrix.config }}
+
+      - name: Analyze and upload results
+        uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:${{ matrix.language }}