diff --git a/.github/workflows/secure-inputs.yml b/.github/workflows/secure-inputs.yml
new file mode 100644
index 0000000..1eb022d
--- /dev/null
+++ b/.github/workflows/secure-inputs.yml
@@ -0,0 +1,26 @@
+name: Secure Input Scan
+
+# Scans pull requests, issues, and comments for known attack vectors:
+# - Hidden Unicode characters incl. Unicode Tag Characters (AI instruction embedding)
+# - Bidirectional text overrides (Trojan Source)
+# - Shell / template / script injection
+# - Prompt injection targeting AI agents in CI/CD pipelines
+# See: devops-actions/.github/.github/workflows/secure-inputs.yml
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+  issues:
+    types: [opened, edited]
+
+  issue_comment:
+    types: [created, edited]
+
+permissions:
+  contents: read
+
+jobs:
+  scan-inputs:
+    uses: devops-actions/.github/.github/workflows/secure-inputs.yml@b77cea6d7ba1cd4e001581783cc592bbb63ce46d # main
+    permissions:
+      contents: read