diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7c9e73a..1db0077 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -3,9 +3,9 @@ name: CodeQL
 on:
   push:
     branches: [main]
-    paths: ['src/**', 'scripts/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml']
+    paths: ['src/**', 'scripts/**', 'test/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml']
   pull_request:
-    paths: ['src/**', 'scripts/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml']
+    paths: ['src/**', 'scripts/**', 'test/**', 'package.json', 'pnpm-lock.yaml', 'pnpm-workspace.yaml', '.github/workflows/codeql.yml']
   workflow_dispatch:
 
 permissions:
@@ -35,4 +35,5 @@ jobs:
             paths:
               - src
               - scripts
+              - test
       - uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
diff --git a/SECURITY.md b/SECURITY.md
index d78b27d..ad411c9 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -31,6 +31,10 @@ gh attestation verify setup-zig-v1.0.0.tar.gz -R ekkolon/setup-zig \
 
 The release also provides `sbom.cdx.json` and `SHA256SUMS`. The `v1` major tag intentionally moves to compatible releases; pin a full action commit SHA or an immutable version tag when evaluating a fixed dependency. Attestations identify the publishing workflow and artifacts, but do not certify that the code is vulnerability-free or compliant with a particular standard.
 
+## Code scanning
+
+CodeQL analyzes maintained source in `src/`, `scripts/`, and `test/`. The generated `dist/` bundles include third-party libraries; CI checks that they reproduce from the lockfile and audits dependencies, including build tools. Review findings in bundled code against their upstream context before treating them as vulnerabilities.
+
 ## Runner and cache trust
 
 GitHub's normal cache access rules apply. Build caches contain unsigned compiler output and packages, so treat them as workflow data. Use `cache: false` for jobs that must rebuild without restored build data. `cache-read-only` prevents this action from uploading caches; it does not make restored data trusted.
diff --git a/test/package.test.ts b/test/package.test.ts
index e281194..9bdffc5 100644
--- a/test/package.test.ts
+++ b/test/package.test.ts
@@ -82,3 +82,21 @@ test('releases require immutability and attest their archive and SBOM', async ()
   assert.ok(immutabilityCheck > publishScript.indexOf('gh release create'));
   assert.ok(immutabilityCheck < publishScript.indexOf('major='));
 });
+
+test('CodeQL checks maintained source rather than generated bundles', async () => {
+  const workflow = parse(
+    await readFile('.github/workflows/codeql.yml', 'utf8'),
+  );
+  const steps = workflow.jobs.analyze.steps;
+  const init = steps.find((step: {uses?: string}) =>
+    step.uses?.startsWith('github/codeql-action/init@'),
+  );
+  const config = parse(init.with.config);
+  assert.deepEqual(config.paths, ['src', 'scripts', 'test']);
+  assert.ok(!config.paths.includes('dist'));
+  assert.ok(
+    steps.some((step: {uses?: string}) =>
+      step.uses?.startsWith('github/codeql-action/analyze@'),
+    ),
+  );
+});