diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index fce676d5c..cb4f530e1 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -200,6 +200,7 @@ jobs:
         run: >-
           ./mvnw 
           -B 
+          -Pdependency-scan
           -T8
           -U
           --no-transfer-progress
@@ -211,3 +212,12 @@ jobs:
           -Dmaven.test.skip
           -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
           verify
+
+      - name: Archive Dependency Scan reports
+        uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: dependency-scan-report
+          path: |
+            **/target/dependency-check-report.html
+          retention-days: 30
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 9df03a498..bf453d5a6 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -145,6 +145,7 @@ jobs:
         run: >-
           ./mvnw 
           -B 
+          -Pdependency-scan
           -T8
           -U
           --no-transfer-progress
@@ -156,3 +157,12 @@ jobs:
           -Dmaven.test.skip
           -Dmaven.wagon.httpconnectionManager.ttlSeconds=120
           verify
+
+      - name: Archive Dependency Scan reports
+        uses: actions/upload-artifact@v3
+        if: always()
+        with:
+          name: dependency-scan-report
+          path: |
+            **/target/dependency-check-report.html
+          retention-days: 30
diff --git a/acceptance-tests/pom.xml b/acceptance-tests/pom.xml
index f98db9b09..04c190b6f 100644
--- a/acceptance-tests/pom.xml
+++ b/acceptance-tests/pom.xml
@@ -33,6 +33,7 @@
     <maven.deploy.skip>true</maven.deploy.skip>
     <maven.jar.skip>true</maven.jar.skip>
     <maven.javadoc.skip>true</maven.javadoc.skip>
+    <skip-dependency-scan>true</skip-dependency-scan>
   </properties>
 
   <dependencyManagement>
diff --git a/java-compiler-testing/security-suppressions.xml b/java-compiler-testing/security-suppressions.xml
new file mode 100644
index 000000000..06f45d44d
--- /dev/null
+++ b/java-compiler-testing/security-suppressions.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+  <!-- See https://jeremylong.github.io/DependencyCheck/general/suppression.html for instructions. -->
+</suppressions>
diff --git a/pom.xml b/pom.xml
index cd1e1b6c9..d98eceefc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -57,6 +57,7 @@
     <slf4j.version>2.0.4</slf4j.version>
 
     <!-- Plugins -->
+    <dependencycheck.version>7.3.2</dependencycheck.version>
     <gmaven-plugin.version>2.1.0</gmaven-plugin.version>
     <jacoco-maven-plugin.version>0.8.8</jacoco-maven-plugin.version>
     <license-maven-plugin.version>4.1</license-maven-plugin.version>
@@ -87,11 +88,14 @@
       -Xshare:off
     </argLine>
 
+    <!-- Scanning -->
+    <skip-dependency-scan>false</skip-dependency-scan>
+
     <!-- Project flags -->
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
     <!-- JavaDocs -->
-    <javadoc-excluded-packages />
+    <javadoc-excluded-packages/>
 
     <project-organization-url>https://github.com/ascopes</project-organization-url>
     <project-scm-url>${project.organization.url}/java-compiler-testing</project-scm-url>
@@ -184,49 +188,6 @@
   <build>
     <pluginManagement>
       <plugins>
-        <plugin>
-          <!-- Groovy compiler -->
-          <groupId>org.codehaus.gmavenplus</groupId>
-          <artifactId>gmavenplus-plugin</artifactId>
-          <version>${gmaven-plugin.version}</version>
-
-          <executions>
-            <execution>
-              <goals>
-                <goal>addSources</goal>
-                <goal>addTestSources</goal>
-                <goal>compile</goal>
-                <goal>compileTests</goal>
-              </goals>
-            </execution>
-          </executions>
-        </plugin>
-
-        <plugin>
-          <!-- Coverage tracing -->
-          <groupId>org.jacoco</groupId>
-          <artifactId>jacoco-maven-plugin</artifactId>
-          <version>${jacoco-maven-plugin.version}</version>
-
-          <executions>
-            <execution>
-              <id>add-coverage-agent-to-surefire-args</id>
-              <phase>initialize</phase>
-              <goals>
-                <goal>prepare-agent</goal>
-              </goals>
-            </execution>
-
-            <execution>
-              <id>report-coverage</id>
-              <phase>test</phase>
-              <goals>
-                <goal>report</goal>
-              </goals>
-            </execution>
-          </executions>
-        </plugin>
-
         <plugin>
           <!-- Java compiler config -->
           <groupId>org.apache.maven.plugins</groupId>
@@ -281,7 +242,8 @@
               <link>https://docs.oracle.com/en/java/javase/11/docs/api</link>
               <link>https://javadoc.io/doc/com.google.jimfs/jimfs/${jimfs.version}</link>
               <link>https://javadoc.io/doc/com.google.code.findbugs/jsr305/${jsr305.version}</link>
-              <link>https://javadoc.io/doc/org.apiguardian/apiguardian-api/${apiguardian.version}</link>
+              <link>https://javadoc.io/doc/org.apiguardian/apiguardian-api/${apiguardian.version}
+              </link>
               <link>https://javadoc.io/doc/org.assertj/assertj-core/${assertj.version}</link>
               <link>https://javadoc.io/doc/org.slf4j/slf4j-api/${slf4j.version}</link>
               <link>https://junit.org/junit5/docs/${junit.version}/api</link>
@@ -331,6 +293,49 @@
             </dependency>
           </dependencies>
         </plugin>
+
+        <plugin>
+          <!-- Groovy compiler -->
+          <groupId>org.codehaus.gmavenplus</groupId>
+          <artifactId>gmavenplus-plugin</artifactId>
+          <version>${gmaven-plugin.version}</version>
+
+          <executions>
+            <execution>
+              <goals>
+                <goal>addSources</goal>
+                <goal>addTestSources</goal>
+                <goal>compile</goal>
+                <goal>compileTests</goal>
+              </goals>
+            </execution>
+          </executions>
+        </plugin>
+
+        <plugin>
+          <!-- Coverage tracing -->
+          <groupId>org.jacoco</groupId>
+          <artifactId>jacoco-maven-plugin</artifactId>
+          <version>${jacoco-maven-plugin.version}</version>
+
+          <executions>
+            <execution>
+              <id>add-coverage-agent-to-surefire-args</id>
+              <phase>initialize</phase>
+              <goals>
+                <goal>prepare-agent</goal>
+              </goals>
+            </execution>
+
+            <execution>
+              <id>report-coverage</id>
+              <phase>test</phase>
+              <goals>
+                <goal>report</goal>
+              </goals>
+            </execution>
+          </executions>
+        </plugin>
       </plugins>
     </pluginManagement>
 
@@ -416,5 +421,40 @@
         <hide-test-logs-in-console>false</hide-test-logs-in-console>
       </properties>
     </profile>
+
+    <profile>
+      <id>dependency-scan</id>
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.owasp</groupId>
+            <artifactId>dependency-check-maven</artifactId>
+            <version>${dependencycheck.version}</version>
+
+            <configuration>
+              <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
+              <formats>
+                <format>html</format>
+                <format>junit</format>
+              </formats>
+
+              <skip>${skip-dependency-scan}</skip>
+              <skipTestScope>true</skipTestScope>
+              <suppressionFile>${project.basedir}/security-suppressions.xml</suppressionFile>
+            </configuration>
+
+            <executions>
+              <execution>
+                <id>dependency-scan</id>
+                <phase>verify</phase>
+                <goals>
+                  <goal>check</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
+    </profile>
   </profiles>
 </project>
diff --git a/security-suppressions.xml b/security-suppressions.xml
new file mode 100644
index 000000000..06f45d44d
--- /dev/null
+++ b/security-suppressions.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+  <!-- See https://jeremylong.github.io/DependencyCheck/general/suppression.html for instructions. -->
+</suppressions>