diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aa2143e..744d785 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -69,6 +69,26 @@ jobs:
         with:
           version: v2.14.0
 
+  sonar:
+    runs-on: ubuntu-latest
+    env:
+      HAS_SONAR_TOKEN: ${{ secrets.SONAR_TOKEN != '' }}   # false on fork pull requests; the scan is skipped there
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+        with:
+          go-version-file: go.mod
+      - name: Test with coverage
+        if: env.HAS_SONAR_TOKEN == 'true'
+        run: go test -count=1 -coverprofile=coverage.out ./...
+      - uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
+        if: env.HAS_SONAR_TOKEN == 'true'
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
   govulncheck:
     runs-on: ubuntu-latest
     steps:
diff --git a/README.md b/README.md
index b20cd18..fd172fb 100644
--- a/README.md
+++ b/README.md
@@ -14,6 +14,7 @@ hookgate is a lightweight webhook gateway: a single static binary that checks ea
 [![Release](https://img.shields.io/github/v/release/mrrobertkent/hookgate)](https://github.com/mrrobertkent/hookgate/releases/latest)
 [![Go Reference](https://pkg.go.dev/badge/github.com/mrrobertkent/hookgate.svg)](https://pkg.go.dev/github.com/mrrobertkent/hookgate)
 [![License](https://img.shields.io/github/license/mrrobertkent/hookgate)](LICENSE)
+[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=mrrobertkent_hookgate&metric=alert_status)](https://sonarcloud.io/summary/new_code?id=mrrobertkent_hookgate)
 [![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/mrrobertkent/hookgate/badge)](https://scorecard.dev/viewer/?uri=github.com/mrrobertkent/hookgate)
 [![Container](https://img.shields.io/badge/ghcr.io-mrrobertkent%2Fhookgate-blue?logo=docker)](https://github.com/mrrobertkent/hookgate/pkgs/container/hookgate)
 
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 0000000..f1ee50b
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,7 @@
+sonar.organization=mrrobertkent
+sonar.projectKey=mrrobertkent_hookgate
+sonar.sources=.
+sonar.tests=.
+sonar.test.inclusions=**/*_test.go
+sonar.exclusions=dist/**,**/*_test.go
+sonar.go.coverage.reportPaths=coverage.out