diff --git a/.github/workflows/plumber.yml b/.github/workflows/plumber.yml
new file mode 100644
index 000000000..79c48a006
--- /dev/null
+++ b/.github/workflows/plumber.yml
@@ -0,0 +1,35 @@
+name: plumber
+
+on:
+  push:
+    branches:
+      - master
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  plumber:
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+      security-events: write
+      # Needed by score-push to publish the score for the README badge.
+      id-token: write
+    steps:
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+
+      - uses: getplumber/plumber@95c19b0d5cf54d1aeecbd78ceda33cc32581b093 # v0.4.30
+        with:
+          # Code scanning upload needs security-events write, which PRs
+          # from forks do not get. The report stays available as a
+          # workflow artifact there.
+          upload-sarif: ${{ github.event.pull_request.head.repo.fork != true }}
+          # Publishes the score to score.getplumber.io, which feeds the
+          # badge in the README. A failed push never fails the run.
+          score-push: true
+          # Gate at 85 points instead of the all-or-nothing default,
+          # leaves room for a small finding without blocking PRs.
+          min-points: 85
diff --git a/.plumber.yaml b/.plumber.yaml
new file mode 100644
index 000000000..9dffde4c3
--- /dev/null
+++ b/.plumber.yaml
@@ -0,0 +1,21 @@
+# Plumber overlay: inherits every control from the CLI's built-in
+# baseline, only the differences for this repo are written here.
+# Run 'plumber config resolve' to see the full effective config.
+extends: plumber:default
+version: '2.0'
+
+github:
+  controls:
+    githubActionMustComeFromAuthorizedSources:
+      # Keep the curated default list and trust the rust-toolchain
+      # action this repo already uses on top of it.
+      includePlumberDefaults: true
+      trustedGithubActions:
+        - dtolnay/rust-toolchain
+
+    # Off for now: the finding is rustup's own install script inside
+    # rust-toolchain, the standard way every Rust CI bootstraps a
+    # toolchain. Nothing repo-side to fix until upstream ships a
+    # checksummed install path.
+    actionsMustNotExecuteMutableRemoteCode:
+      enabled: false
diff --git a/README.md b/README.md
index 54a7158a5..023aa50b5 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,7 @@ other popular search tools like The Silver Searcher, ack and grep.
 [![Build status](https://github.com/BurntSushi/ripgrep/workflows/ci/badge.svg)](https://github.com/BurntSushi/ripgrep/actions)
 [![Crates.io](https://img.shields.io/crates/v/ripgrep.svg)](https://crates.io/crates/ripgrep)
 [![Packaging status](https://repology.org/badge/tiny-repos/ripgrep.svg)](https://repology.org/project/ripgrep/badges)
+[![Plumber Score](https://score.getplumber.io/github.com/BurntSushi/ripgrep.svg)](https://score.getplumber.io/github.com/BurntSushi/ripgrep)
 
 Dual-licensed under MIT or the [UNLICENSE](https://unlicense.org).