diff --git a/.github/workflows/scan.yml b/.github/workflows/scan.yml
index 3b1fd23..c998160 100644
--- a/.github/workflows/scan.yml
+++ b/.github/workflows/scan.yml
@@ -37,6 +37,11 @@ jobs:
       - name: Checkout consumer repo
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
+          # On a pull_request event the default ref is refs/pull/<N>/merge, a ref
+          # GitHub does not reliably publish - fetching it fails with "couldn't find
+          # remote ref" and reds the whole scan. Check out the PR head commit directly
+          # (deterministic, always present); fall back to the pushed commit on push.
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
 
       # Check out SecureCheck at the SAME ref the consumer pinned (github.workflow_ref
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..3e20fe8
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,18 @@
+name: Security Scan
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    # Dogfood: run SecureCheck's own reusable scan against this repo. This also acts
+    # as the regression guard for the scan workflow itself - if the pull_request
+    # checkout (or anything else in scan.yml) breaks again, this job goes red on the
+    # next PR instead of silently failing only in downstream consumer repos.
+    uses: ./.github/workflows/scan.yml
+    secrets: inherit