diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
new file mode 100644
index 0000000..f4301f3
--- /dev/null
+++ b/.github/workflows/scorecard.yaml
@@ -0,0 +1,26 @@
+name: 🛡️ scorecard
+on:
+  branch_protection_rule:
+  schedule:
+    - cron: "30 7 * * 2"
+  push:
+    branches: ["main"]
+  workflow_dispatch:
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+permissions: {}
+jobs:
+  analysis:
+    name: 🛡️ Scorecard analysis
+    if: github.repository == 'tox-dev/devpi-process'
+    permissions:
+      actions: read # read workflow runs for the Packaging check
+      checks: read # read check runs for the CI-Tests and SAST checks
+      contents: read # check out and scan the repository
+      id-token: write # authenticate the results published to the scorecard API
+      issues: read # read issue activity for the Maintained check
+      pull-requests: read # read reviews for the Code-Review check
+      security-events: write # upload the SARIF results to code scanning
+      statuses: read # read commit statuses for the CI-Tests check
+    uses: tox-dev/github-workflows/.github/workflows/scorecard.yaml@e0ddedd1f8d78ed93d5eb8290f37675f6092bddf
diff --git a/README.md b/README.md
index 9ed93c2..5446e15 100644
--- a/README.md
+++ b/README.md
@@ -8,6 +8,8 @@ See the [changelog](CHANGELOG.md) for released changes and [contributing guide](
 [![Downloads](https://static.pepy.tech/badge/devpi-process/month)](https://pepy.tech/project/devpi-process)
 [![PyPI - License](https://img.shields.io/pypi/l/devpi-process?style=flat-square)](https://opensource.org/licenses/MIT)
 [![check](https://github.com/tox-dev/devpi-process/actions/workflows/check.yaml/badge.svg)](https://github.com/tox-dev/devpi-process/actions/workflows/check.yaml)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/tox-dev/devpi-process/badge)](https://scorecard.dev/viewer/?uri=github.com/tox-dev/devpi-process)
+[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/16263/badge)](https://www.bestpractices.dev/projects/16263)
 
 Allows you to create [devpi](https://devpi.net/docs/devpi/devpi/stable/+d/index.html) server process with indexes, and
 upload artifacts to that programmatically.