diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 2d846258..31a12f8b 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -17,6 +17,9 @@ jobs:
         steps:
             - name: Checkout
               uses: actions/checkout@v5
+              with:
+                  # SonarQube reads git history to attribute issues to authors.
+                  fetch-depth: 0
 
             - name: Install uv
               uses: astral-sh/setup-uv@v7
@@ -47,3 +50,13 @@ jobs:
                   title: Coverage Report
                   create-new-comment: false
                   hide-report: false
+
+
+            # coverage.xml is written by the pytest step above. Fork PRs get no secrets,
+            # so the scan could only fail on a missing token -- skip rather than fail red.
+            - name: SonarQube analysis
+              if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+              uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
+              env:
+                  SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+                  SONAR_HOST_URL: ${{ secrets.SONAR_HOST_URL }}
diff --git a/sonar-project.properties b/sonar-project.properties
new file mode 100644
index 00000000..1cf22f24
--- /dev/null
+++ b/sonar-project.properties
@@ -0,0 +1,14 @@
+sonar.projectKey=automation
+sonar.projectName=automation
+
+# tests/ is top level, so sources and tests are already disjoint -- SonarQube aborts if a
+# file is reachable from both.
+sonar.sources=openhands
+sonar.tests=tests
+
+# Written by tests.yml as --cov-report=xml:coverage.xml, in the same job as the scan, so
+# the report always matches the analysed commit.
+sonar.python.coverage.reportPaths=coverage.xml
+
+sonar.python.version=3.12
+sonar.sourceEncoding=UTF-8