diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
new file mode 100644
index 0000000..c912691
--- /dev/null
+++ b/.github/workflows/pipeline.yml
@@ -0,0 +1,36 @@
+# Gated scan pipeline from listepo/infra: CodeQL, Semgrep and Snyk in parallel behind
+# `pipeline / gate`. Rust CI is off (`rust: false`): the local ci.yml covers the
+# Rust crates.
+# Inputs, secrets and permissions: listepo/infra docs/reusable-workflows.md.
+name: pipeline
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+    types: [opened, synchronize, reopened, ready_for_review]
+  schedule:
+    - cron: "17 4 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: pipeline-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+jobs:
+  pipeline:
+    uses: listepo/infra/.github/workflows/pipeline.yml@189816ac5a375e18e0235044970efcbc40e3cabd
+    permissions:
+      contents: read
+      security-events: write
+      actions: read
+    with:
+      rust: false
+      # Not scanned: swift (no build-mode none), kotlin (needs a build), python (vendored).
+      codeql-languages: '["actions", "c-cpp", "javascript-typescript", "rust"]'
+    secrets:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}