diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b8b9d3..fb653d4 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,8 @@
 
 ### Maintenance
 
+- Add CodeQL analysis on pull requests, `main`, the CI preview branch, weekly
+  schedule, and manual dispatch.
 - Document the read-only `metadata --json`, `status --json`, and
   `doctor --json` control surface for launchers, automation, and CI checks.