diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..7023da6e
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,10 @@
+version: 2
+updates:
+  # Keep workflow actions current; one grouped PR per week.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns: ["*"]
diff --git a/.github/workflows/bindings-sysman-python-checks.yml b/.github/workflows/bindings-sysman-python-checks.yml
index 5f1980f0..a8aa30ac 100644
--- a/.github/workflows/bindings-sysman-python-checks.yml
+++ b/.github/workflows/bindings-sysman-python-checks.yml
@@ -25,6 +25,9 @@ on:
 env:
   PYTHON_VERSION: '3.10'
 
+permissions:
+  contents: read
+
 jobs:
   validation-checks:
     name: Validation Checks
diff --git a/.github/workflows/bindings-sysman-python-security-scan.yml b/.github/workflows/bindings-sysman-python-security-scan.yml
index ddcf752d..5d1d0f3b 100644
--- a/.github/workflows/bindings-sysman-python-security-scan.yml
+++ b/.github/workflows/bindings-sysman-python-security-scan.yml
@@ -22,6 +22,9 @@ on:
       - 'bindings/sysman/python/**'
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   bandit:
     name: Bandit Security Analysis
diff --git a/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml b/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
index 2db85abc..07369987 100644
--- a/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
+++ b/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
@@ -25,6 +25,9 @@ on:
 env:
   PYTHON_VERSION: '3.10'
 
+permissions:
+  contents: read
+
 jobs:
   unit-tests-linux:
     name: Linux - Unit Tests & Coverage Analysis
@@ -34,7 +37,6 @@ jobs:
         working-directory: bindings/sysman/python
     permissions:
       contents: read
-      checks: write        # For check results
 
     steps:
       - name: Checkout code
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..c6d6126d
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,47 @@
+name: CodeQL
+
+# Static analysis (SAST) of the loader C/C++ sources, the Python bindings and
+# the workflow files. Results go to the Security > Code scanning tab.
+on:
+  # Allow manual runs from the Actions tab ("Run workflow" button).
+  workflow_dispatch:
+  push:
+    branches: [ "master" ]
+  pull_request:
+    branches: [ "master" ]
+  schedule:
+    - cron: '37 19 * * 3'
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'oneapi-src'
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [ "c-cpp", "python", "actions" ]
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
+        with:
+          persist-credentials: false
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        with:
+          category: "/language:${{ matrix.language }}"