diff --git a/.github/workflows/check-scorecard.yaml b/.github/workflows/check-scorecard.yaml
new file mode 100644
index 00000000..a80445d9
--- /dev/null
+++ b/.github/workflows/check-scorecard.yaml
@@ -0,0 +1,46 @@
+name: OpenSSF Scorecard
+
+on:
+  push:
+    branches: [main]
+  schedule:
+  - cron: '0 8 * * 6'
+  workflow_dispatch:
+
+# Scorecard requires read-all at workflow level when publishing results.
+permissions: read-all
+
+jobs:
+  analyze-scorecard:
+    name: Analyze
+    if: github.repository == 'zealdocs/zeal'
+    runs-on: ubuntu-24.04
+
+    permissions:
+      security-events: write
+      id-token: write
+
+    steps:
+    - name: Checkout Repository
+      uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+
+    - name: Run Scorecard
+      uses: ossf/scorecard-action@v2.4.3
+      with:
+        results_file: results.sarif
+        results_format: sarif
+        publish_results: true
+
+    - name: Upload Results
+      uses: actions/upload-artifact@v7
+      with:
+        name: scorecard-results
+        path: results.sarif
+        retention-days: 5
+
+    - name: Upload to Code Scanning
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: results.sarif