diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 716a8dc2f..db9614eed 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -16,6 +16,7 @@ on:
   merge_group:
   schedule:
     - cron: "36 6 * * 4" # run every Thursday at 06:36 UTC
+  workflow_dispatch:
 
 concurrency:
   group: ${{ github.ref_name }}-codeql
@@ -29,34 +30,50 @@ jobs:
     name: Checks and variables
     runs-on: ubuntu-24.04
     outputs:
-      docs_only: ${{ github.event.pull_request && steps.docs.outputs.docs_only == 'true' }}
+      docs_only: ${{ steps.docs.outputs.docs_only }}
     steps:
       - name: Checkout Repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - name: Filter only docs changes
+      - name: Determine whether changes are docs-only
         id: docs
+        shell: bash --noprofile --norc -o pipefail {0}
         run: |
-          files=$(git diff --name-only HEAD^ | egrep -v "^site/" | egrep -v "^examples/" | egrep -v "^README.md")
+          # Non-PR events should always run CodeQL.
+          if [ "${{ github.event_name }}" != "pull_request" ]; then
+            echo "docs_only=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
+          git fetch origin "${{ github.base_ref }}"
+
+          files=$(git diff --name-only "origin/${{ github.base_ref }}"...HEAD \
+            | egrep -v "^site/" \
+            | egrep -v "^examples/" \
+            | egrep -v "^README.md")
+
           if [ -z "$files" ]; then
-            echo "docs_only=true" >> $GITHUB_OUTPUT
+            echo "docs_only=true" >> "$GITHUB_OUTPUT"
           else
-            echo "docs_only=false" >> $GITHUB_OUTPUT
+            echo "docs_only=false" >> "$GITHUB_OUTPUT"
           fi
-          echo $files
-          cat $GITHUB_OUTPUT
-        shell: bash --noprofile --norc -o pipefail {0}
+
+          echo "Files changed:"
+          echo "$files"
+          cat "$GITHUB_OUTPUT"
 
   analyze:
-    if: ${{ needs.checks.outputs.docs_only != 'true' }}
-    needs: [checks]
+    needs: checks
+    if: ${{ github.event_name != 'pull_request' || needs.checks.outputs.docs_only != 'true' }}
+
     permissions:
-      actions: read # for github/codeql-action/init to get workflow details
-      contents: read # for actions/checkout to fetch code
+      actions: read
+      contents: read
       packages: read
-      security-events: write # for github/codeql-action/autobuild to send a status report
+      security-events: write
+
     name: Analyze
     uses: nginx/compliance-rules/.github/workflows/codeql.yml@543d32464b56e6a695939f41ba8009cbb10e413a # v0.3.3
     with: