diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 731e4af..4838437 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -35,11 +35,44 @@ jobs:
           deploy-pull-request: true
           artifactory-reader-role: private-reader    # Override default public-reader
           artifactory-deployer-role: qa-deployer     # Override default public-deployer
+          sonar-platform: none
+      - name: Upload build output for scanning
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: build-output-${{ steps.build-step.outputs.BUILD_NUMBER }}
+          path: '**/target'
+          retention-days: 3
+
+  scan:
+    name: Scan
+    needs: build
+    runs-on: github-ubuntu-latest-s
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
+        with:
+          version: 2026.9.11
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-output-${{ needs.build.outputs.build-number }}
+      - uses: SonarSource/ci-github-actions/build-maven@66c890622c26a71ea49efeb7e269bd58be455e77 # PR 348; re-pin to @v1 once merged
+        with:
+          deploy: false
+          skip-build: true
+          sonar-platform: next
+          artifactory-reader-role: private-reader
+          artifactory-deployer-role: qa-deployer
 
   promote:
     name: Promote
     needs:
      - build
+     - scan
     if: ${{ needs.build.outputs.deployed }}
     runs-on: github-ubuntu-latest-s  # Public repo - use custom GitHub-hosted runner
     permissions: