diff --git a/.github/.fossa.yml b/.github/.fossa.yml
new file mode 100644
index 0000000..2da2a79
--- /dev/null
+++ b/.github/.fossa.yml
@@ -0,0 +1,25 @@
+version: 3
+
+project:
+  locator: SolaceLabs_solace-queuebrowser-datasource
+  id: SolaceLabs_solace-queuebrowser-datasource
+  name: solace-queuebrowser-datasource
+  teams: []
+  labels:
+    - javascript
+
+vendoredDependencies:
+  forceRescans: false
+  scanMethod: CLILicenseScan
+  licenseScanPathFilters:
+    exclude:
+      - "./.git"
+      - "./.github"
+
+paths:
+  exclude:
+    - ./.git
+    - ./.github
+
+telemetry:
+  scope: full
diff --git a/.github/workflow-config.json b/.github/workflow-config.json
new file mode 100644
index 0000000..cacb8de
--- /dev/null
+++ b/.github/workflow-config.json
@@ -0,0 +1,8 @@
+{
+  "sca_scanning": {
+    "fossa": {
+      "policy": { "mode": "REPORT" },
+      "vulnerability": { "mode": "REPORT" }
+    }
+  }
+}
diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml
new file mode 100644
index 0000000..9b397bf
--- /dev/null
+++ b/.github/workflows/sca-scan-and-guard.yml
@@ -0,0 +1,56 @@
+name: SCA Scan
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  # Allows the scan to be re-run against trunk without waiting for a push, which
+  # matters when a merge commit carries [skip ci] and produces no run at all.
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write
+  # Required by the shared SCA workflow, which declares it. A called workflow
+  # cannot be granted a permission the caller lacks, so removing this fails the
+  # whole run at startup with zero jobs and no annotation.
+  packages: read
+  actions: read
+  statuses: write
+  checks: write
+  pull-requests: write
+
+jobs:
+  sca_scan:
+    uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@c689e87fd881013c2e5009bf6e751b49cae7527b # main
+    with:
+      # .fossa.yml lives under .github/, so the CLI has to be pointed at it.
+      # Without this it silently falls back to defaults and registers the scan
+      # under a different project.
+      additional_scan_params: |
+        fossa.config=.github/.fossa.yml
+      # Pinned: the shared workflow still defaults to node 20, which is end-of-life.
+      node_version: "24"
+      setup_actions: '["setup-node"]'
+    secrets:
+      FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
+
+  # The reusable workflow owns the default-branch check, so a pull request run
+  # scans without writing and a run on trunk writes.
+  update_manifest:
+    needs: sca_scan
+    if: needs.sca_scan.result == 'success'
+    uses: SolaceDev/solace-public-workflows/.github/workflows/update-manifest.yaml@c689e87fd881013c2e5009bf6e751b49cae7527b # main
+    with:
+      table_name: solace-cloud-manifest
+      item: |
+        {
+          "squad": "cto",
+          "repository": "${{ github.event.repository.name }}",
+          "dev": {
+            "sha": "${{ github.sha }}",
+            "version": "${{ github.ref_name }}"
+          }
+        }
+    secrets:
+      MANIFEST_AWS_ROLE: ${{ secrets.MANIFEST_AWS_ROLE }}