diff --git a/.github/workflows/malcontent.yaml b/.github/workflows/malcontent.yaml
new file mode 100644
index 0000000..9a45e3e
--- /dev/null
+++ b/.github/workflows/malcontent.yaml
@@ -0,0 +1,42 @@
+name: Malcontent Analysis
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions: {}
+
+jobs:
+  malcontent:
+    runs-on: ubuntu-latest
+
+    permissions:
+      contents: read
+      pull-requests: write
+
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@002fdce3c6a235733a90a27c80493a3241e56863 # v2.12.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0  # Fetch all history for proper diff analysis
+
+      - name: Run Malcontent Analysis
+        id: malcontent
+        uses: chainguard-dev/malcontent-action@053384afe0bb069ba7e2996bd8c0863731406002 # v0.4
+        with:
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+
+      # NB: Could also set `fail-on-increase: false` and use `if: ${{steps.malcontent.outputs.risk-delta > 5}}` to allow some risk increase
+
+      - name: Upload SARIF
+        uses: github/codeql-action/upload-sarif@ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 #v3.29.0 - 11 Jun 2025
+        if: always() # Upload even if the malcontent check fails
+        with:
+          sarif_file: ${{ steps.malcontent.outputs.sarif-file }}
+          category: malcontent