diff --git a/.github/workflows/cgo.yml b/.github/workflows/cgo.yml
index 741507cf925..44e0d93754f 100644
--- a/.github/workflows/cgo.yml
+++ b/.github/workflows/cgo.yml
@@ -529,6 +529,36 @@ jobs:
       env:
         GH_TOKEN: ${{ github.token }}
 
+  poutine:
+    needs: [build, validate-yaml]
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      contents: read
+    concurrency:
+      group: ci-${{ github.ref }}-poutine
+      cancel-in-progress: true
+    steps:
+    - name: Restore checkout
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9   # v6.1.0
+      with:
+        path: .
+        key: checkout-${{ github.sha }}
+        fail-on-cache-miss: true
+
+    - name: Download gh-aw binary
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16   # v4
+      with:
+        name: gh-aw-linux-amd64
+
+    - name: Make gh-aw executable
+      run: chmod +x gh-aw
+
+    - name: Run poutine security scan on all workflows
+      run: ./gh-aw compile --poutine --verbose
+      env:
+        GH_TOKEN: ${{ github.token }}
+
   build-wasm:
     needs: [checkout-cache]
     runs-on: ubuntu-latest
@@ -2583,6 +2613,7 @@ jobs:
     - build
     - build-wasm
     - zizmor
+    - poutine
     - bench
     - check-validator-sizes
     - lint-go