diff --git a/.github/workflows/dhscanner-sast.yml b/.github/workflows/dhscanner-sast.yml
new file mode 100644
index 0000000..fab6969
--- /dev/null
+++ b/.github/workflows/dhscanner-sast.yml
@@ -0,0 +1,59 @@
+name: dhscanner-sast
+
+on:
+  push:
+    branches:
+      - main
+      - chore/dhscanner-sast
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+  security-events: write
+  actions: read
+
+jobs:
+  run-dhscanner:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: clone dhscanner (with submodules)
+        run: |
+          # Upstream main dropped compose.rel.*.yaml; docs still point at main.
+          git clone --recurse-submodules --branch v1.0.0 \
+            https://github.com/OrenGitHub/dhscanner
+          cd dhscanner
+          docker compose -f compose.rel.x64.yaml up -d
+          for i in $(seq 1 60); do
+            if (echo >/dev/tcp/127.0.0.1/443) >/dev/null 2>&1; then
+              exit 0
+            fi
+            sleep 5
+          done
+          echo "dhscanner did not become ready on :443"
+          docker compose -f compose.rel.x64.yaml ps
+          exit 1
+
+      - name: checkout specific tag
+        uses: actions/checkout@v4
+
+      - name: send the whole repo to dhscanner
+        run: |
+          tar -cz . | curl -v -X POST \
+            -H "X-Code-Sent-To-External-Server: false" \
+            -H "Content-Type: application/octet-stream" \
+            --data-binary @- http://127.0.0.1:443/ > output.sarif
+
+      - name: Upload SARIF results
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: output.sarif
+
+      - name: fail workflow if sarif contains findings
+        run: |
+          if jq '.runs[].results | length > 0' output.sarif | grep -q 'true'; then
+            echo "Sarif findings detected, failing the workflow"
+            exit 1
+          fi