diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 0000000..4932d03
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,6 @@
+# CodeQL configuration for WHCP Windows 11 25H2 certification
+# See: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/static-tools-and-codeql
+disable-default-queries: true
+packs:
+  - microsoft/cpp-queries@0.0.4:codeql-suites/cpp-code-scanning.qls
+  - microsoft/windows-drivers@1.8.0:windows-driver-suites/recommended.qls
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d3936a..81ab004 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,8 +19,6 @@ jobs:
 
       - name: Setup NuGet
         uses: NuGet/setup-nuget@v2
-        with:
-          version: '6.x'
 
       - name: Restore dependencies
         run: nuget restore FrameworkArgb\FrameworkArgb.sln
@@ -54,3 +52,55 @@ jobs:
         with:
           name: framework_win_argb_${{ matrix.configuration }}
           path: bundle
+
+  codeql:
+    runs-on: windows-2022
+    permissions:
+      security-events: write
+    steps:
+      - name: Check out repository code
+        uses: actions/checkout@v4
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v4
+        with:
+          languages: cpp
+          # Pin CodeQL CLI version for WHCP Windows 11 25H2 certification
+          # See: https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/static-tools-and-codeql
+          tools: https://github.com/github/codeql-action/releases/download/codeql-bundle-v2.20.1/codeql-bundle-win64.tar.gz
+          config-file: .github/codeql/codeql-config.yml
+
+      - name: Setup NuGet
+        uses: NuGet/setup-nuget@v2
+
+      - name: Restore dependencies
+        run: nuget restore FrameworkArgb\FrameworkArgb.sln
+
+      - name: Add MSBuild to PATH
+        uses: microsoft/setup-msbuild@v2
+
+      - name: Build solution
+        run: |
+          msbuild FrameworkArgb\FrameworkArgb.sln /property:Configuration=Release /property:Platform=x64
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v4
+        with:
+          output: sarif-results
+
+      - name: Upload SARIF file
+        uses: actions/upload-artifact@v4
+        with:
+          name: codeql-sarif
+          path: sarif-results
+
+      - name: Generate DVL
+        shell: cmd
+        run: |
+          "C:\Program Files (x86)\Windows Kits\10\Tools\dvl\dvl.exe" /manualCreate FrameworkArgb X64 /sarifPath sarif-results
+
+      - name: Upload DVL
+        uses: actions/upload-artifact@v4
+        with:
+          name: dvl
+          path: sarif-results/FrameworkArgb.DVL.XML