diff --git a/.github/workflows/code-ranker.yml b/.github/workflows/code-ranker.yml
new file mode 100644
index 0000000..4b0d7ff
--- /dev/null
+++ b/.github/workflows/code-ranker.yml
@@ -0,0 +1,12 @@
+name: code-ranker
+on:
+  pull_request:
+  push:
+jobs:
+  code-ranker:
+    # Pinned to an immutable commit SHA (supply-chain hardening); the trailing
+    # `# v1` lets Dependabot bump the pin when a new release moves the v1 tag.
+    uses: code-ranker-com/actions/.github/workflows/report.yml@4caae2a061c307b4fa6d517d87a956873957d41c # v1
+    permissions:
+      # Only permission needed — reads your code to analyze it.
+      contents: read