diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 00000000..e3c88370
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,45 @@
+# CodeQL code scanning for every language in the repo that supports `build-mode: none`;
+# results land in the Security tab. Repo default setup must stay off —
+# GitHub rejects advanced-workflow uploads while it is on.
+name: codeql
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  analyze:
+    if: github.event_name != 'pull_request' || !github.event.pull_request.draft
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        # `build-mode: none` for all: every language is extracted from source, so no build runs here.
+        # Not scanned: swift (no `build-mode: none` support), java-kotlin (Kotlin only, and
+        # none mode extracts Java only), ruby (only a CocoaPods Podfile, no Ruby sources), python
+        # (only vendored WAMR test scripts).
+        language: [actions, c-cpp, javascript-typescript, rust]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: github/codeql-action/init@v4
+        with:
+          languages: ${{ matrix.language }}
+          build-mode: none
+          queries: security-and-quality
+      - uses: github/codeql-action/analyze@v4
+        with:
+          category: /language:${{ matrix.language }}
diff --git a/packages/ns-wamr/src/vendors/wamr-rust/wamr-ffi/src/lib.rs b/packages/ns-wamr/src/vendors/wamr-rust/wamr-ffi/src/lib.rs
index 5e130bd7..75ba59dc 100644
--- a/packages/ns-wamr/src/vendors/wamr-rust/wamr-ffi/src/lib.rs
+++ b/packages/ns-wamr/src/vendors/wamr-rust/wamr-ffi/src/lib.rs
@@ -5,6 +5,9 @@
 // Every unsafe operation inside an `unsafe fn` must still name itself, so the
 // SAFETY comments below sit on the actual dereference rather than the header.
 #![deny(unsafe_op_in_unsafe_fn)]
+// The UDL scaffolding generated by `uniffi::include_scaffolding!` defines its metadata as a large
+// `const` array; clippy 1.98 flags that (`large_const_arrays`) in code we do not own.
+#![allow(clippy::large_const_arrays)]
 
 use std::ffi::{c_char, CStr, CString};
 use std::sync::{Arc, Mutex};
diff --git a/packages/ns-wasm3/src/vendors/wasm3-rust/wasm3-ffi/src/lib.rs b/packages/ns-wasm3/src/vendors/wasm3-rust/wasm3-ffi/src/lib.rs
index cd1d9354..58bd93fc 100644
--- a/packages/ns-wasm3/src/vendors/wasm3-rust/wasm3-ffi/src/lib.rs
+++ b/packages/ns-wasm3/src/vendors/wasm3-rust/wasm3-ffi/src/lib.rs
@@ -21,6 +21,9 @@
 //!   `bytecode` field is what keeps them alive.
 
 #![deny(unsafe_op_in_unsafe_fn)]
+// The UDL scaffolding generated by `uniffi::include_scaffolding!` defines its metadata as a large
+// `const` array; clippy 1.98 flags that (`large_const_arrays`) in code we do not own.
+#![allow(clippy::large_const_arrays)]
 
 use std::ffi::{c_char, CStr, CString};
 use std::sync::Arc;