diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..290d1c8
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,19 @@
+name: CodeQL Advanced Scanning
+
+on:
+  workflow_dispatch:
+  push:
+    branches:
+      - master
+  pull_request:
+    branches:
+      - master
+
+jobs:
+  codeql:
+    uses: moonpig/moonpig-ops-pipeline-workflows/.github/workflows/codeql-scan.yml@master
+    with:
+      build-modes: |
+        csharp=manual
+      build-script: ./scripts/codeql-build.sh
+    secrets: inherit
diff --git a/scripts/codeql-build.sh b/scripts/codeql-build.sh
new file mode 100755
index 0000000..996fb86
--- /dev/null
+++ b/scripts/codeql-build.sh
@@ -0,0 +1,15 @@
+#!/bin/bash -e
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORKSPACE="${GITHUB_WORKSPACE:-$ROOT_DIR}"
+
+SOLUTION_PATH="$WORKSPACE/Moonpig.PostOffice.sln"
+
+cd "$WORKSPACE"
+dotnet tool restore
+
+if [[ -f "$SOLUTION_PATH" ]]; then
+  dotnet build "$SOLUTION_PATH" -c Release
+else
+  dotnet build -c Release
+fi