diff --git a/.github/workflows/jenkins-security-scan.yml b/.github/workflows/jenkins-security-scan.yml
new file mode 100644
index 000000000..dbad90b24
--- /dev/null
+++ b/.github/workflows/jenkins-security-scan.yml
@@ -0,0 +1,21 @@
+name: Jenkins Security Scan
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+    types: [ opened, synchronize, reopened ]
+  workflow_dispatch:
+
+permissions:
+  security-events: write
+  contents: read
+  actions: read
+
+jobs:
+  security-scan:
+    uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
+    with:
+      java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate.
+      java-version: 17 # What version of Java to set up for the build.
diff --git a/README.md b/README.md
index 2b198e8c5..7de5575dd 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 ![credentials version](https://img.shields.io/jenkins/plugin/v/credentials?label=credentials)
 ![credentials installs](https://img.shields.io/jenkins/plugin/i/credentials)
 [![MIT license](https://img.shields.io/github/license/jenkinsci/credentials-plugin)](https://github.com/jenkinsci/credentials-plugin/blob/master/LICENSE.txt)
-[![Language grade: Java](https://img.shields.io/lgtm/grade/java/g/jenkinsci/credentials-plugin.svg?logo=lgtm&logoWidth=18)](https://lgtm.com/projects/g/jenkinsci/credentials-plugin/context:java)
+[![security scan](https://github.com/jenkinsci/credentials-plugin/actions/workflows/jenkins-security-scan.yml/badge.svg)](https://github.com/jenkinsci/credentials-plugin/actions/workflows/jenkins-security-scan.yml)
 
 ## Documentation