diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml
new file mode 100644
index 0000000..208db7b
--- /dev/null
+++ b/.github/workflows/code-ranker.yml
@@ -0,0 +1,15 @@
+name: code-ranker
+on:
+  pull_request:
+  push:
+jobs:
+  code-ranker:
+    # Pinned to an immutable commit SHA (supply-chain hardening).
+    uses: code-ranker-com/actions/.github/workflows/report.yml@42c2fba1acd7c99a71875c8eefa171224d8e683c
+    permissions:
+      id-token: write
+      contents: read
+      # No pull-requests: write here — the code-ranker GitHub App posts (and
+      # updates in place) the report comment using its own installation
+      # token, not this workflow's GITHUB_TOKEN.
+      security-events: write