diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
new file mode 100644
index 0000000..55b81c1
--- /dev/null
+++ b/.github/workflows/codeql.yml
@@ -0,0 +1,25 @@
+---
+name: CodeQL Code Scan
+
+on:
+  push:
+    branches: ["main"]
+  schedule:
+    # Check every Monday at 04:36
+    - cron: "36 04 * * 1"
+
+jobs:
+  codeql:
+    uses: mundialis/github-workflows/.github/workflows/codeql.yml@main
+    # the workflow requires permissions that need to be granted by the parent job:
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
diff --git a/.github/workflows/flake8.yml b/.github/workflows/flake8.yml
index 003a791..67e4d5b 100644
--- a/.github/workflows/flake8.yml
+++ b/.github/workflows/flake8.yml
@@ -4,6 +4,9 @@ on:
 - push
 - pull_request
 
+permissions:
+  contents: read
+
 jobs:
 
   flake8-actinia:
diff --git a/.github/workflows/python-publish.yml b/.github/workflows/python-publish.yml
index 5c5fb04..40a3449 100644
--- a/.github/workflows/python-publish.yml
+++ b/.github/workflows/python-publish.yml
@@ -5,6 +5,10 @@ on:
   release:
     types: [published]
 
+permissions:
+  contents: read
+  id-token: write
+
 jobs:
 
   publish-python-test-pypi:
diff --git a/.github/workflows/sbom-vulnerability-scan.yml b/.github/workflows/sbom-vulnerability-scan.yml
new file mode 100644
index 0000000..36ba891
--- /dev/null
+++ b/.github/workflows/sbom-vulnerability-scan.yml
@@ -0,0 +1,21 @@
+---
+name: SBOM Vulnerability Scan
+
+on:
+  push:
+    branches: ["main"]
+  schedule:
+    # Check every Monday at 04:36
+    - cron: "36 04 * * 1"
+  release:
+    types: [published]
+
+jobs:
+  sbom-scan:
+    permissions:
+      contents: read
+      security-events: write
+
+    uses: mundialis/github-workflows/.github/workflows/sbom-vulnerability-scan.yml@main
+    with:
+      pyproject: pyproject.toml 
\ No newline at end of file
diff --git a/.github/workflows/third-party-licenses.yml b/.github/workflows/third-party-licenses.yml
new file mode 100644
index 0000000..7a88bc9
--- /dev/null
+++ b/.github/workflows/third-party-licenses.yml
@@ -0,0 +1,14 @@
+---
+name: Generate Third-Party Licenses
+
+on:
+  release:
+    types: [published]
+
+permissions: { }
+
+jobs:
+  generate-third-party-licenses:
+    uses: mundialis/github-workflows/.github/workflows/third-party-licenses.yml@main
+    with:
+      pyproject: pyproject.toml
\ No newline at end of file