diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..5d55efc4
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,57 @@
+# Restores PR-head CodeQL coverage for this repo.
+#
+# History: commit 83ecc6e (PR #118, "ci: remove local governance workflows
+# duplicated by central required workflows") deleted the previous local
+# .github/workflows/codeql.yml on the assumption that the org-wide required
+# workflow ruleset (ContextualWisdomLab, ruleset id 18156473) already runs
+# ContextualWisdomLab/.github's central codeql-pr.yml against every PR here.
+#
+# That assumption was verified FALSE on 2026-09-02: ruleset 18156473 does not
+# actually include codeql-pr.yml, so this repo has had zero CodeQL coverage on
+# pull requests since #118 merged. This file is an interim, repo-local safety
+# net until an org admin adds codeql-pr.yml to ruleset 18156473 (tracked
+# separately — out of scope for a repo-level change). Remove this file once
+# that ruleset fix is confirmed live.
+#
+# Language: "actions" only, verified against this repo's own file extensions
+# (no first-party Python/JS-TS/Java-Kotlin source; the ~980 .c/.h/.hpp files
+# under packrat/lib/ are vendored R package dependencies, not repo-authored
+# code) and against the CodeQL analyses this repo has actually produced
+# historically (always /language:actions, never anything else).
+name: CodeQL
+
+on:
+  pull_request:
+    branches: ["master"]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  analyze:
+    name: Analyze (actions)
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    steps:
+      - name: Harden runner
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          languages: actions
+          build-mode: none
+
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        with:
+          category: "/language:actions"