diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..16f5bbd
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,25 @@
+name: Semgrep
+
+# Free/OSS Semgrep scan (no Semgrep AppSec Platform token) on every pull
+# request targeting main.
+
+on:
+  pull_request:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  semgrep:
+    name: Semgrep scan
+    runs-on: ubuntu-latest
+    container:
+      image: semgrep/semgrep:1.169.0
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Run Semgrep
+        run: semgrep scan --config p/golang --config p/secrets --error
diff --git a/pkg/deploy/hostname.go b/pkg/deploy/hostname.go
index 921f85b..5ef9012 100644
--- a/pkg/deploy/hostname.go
+++ b/pkg/deploy/hostname.go
@@ -2,7 +2,9 @@ package deploy
 
 import (
 	"fmt"
-	"math/rand"
+	// Non-crypto randomness is fine here: generated instance names are scoped
+	// to the user's own account and are not global identifiers.
+	"math/rand" // nosemgrep: go.lang.security.audit.crypto.math_random.math-random-used
 	"regexp"
 )