diff --git a/README.md b/README.md
index 76da6b6..bbb9b11 100644
--- a/README.md
+++ b/README.md
@@ -529,3 +529,22 @@ with `interface = all` in the `ipp-usb.conf` file, but this has the
 disadvantage of exposing your local USB-connected printer to the
 entire local network, which can be an unwanted side effect, especially
 in a big corporative network.
+
+## Static Analysis
+
+ipp-usb is analyzed by CodeQL (`.github/workflows/codeql.yml`). Because ipp-usb is cgo code, the workflow uses `build-mode: manual` and compiles the daemon itself so CodeQL traces the real build.
+
+### CodeQL Static Analysis Configuration
+
+This repository uses a custom GitHub Actions workflow for CodeQL static analysis located at `.github/workflows/codeql.yml`. To ensure accurate analysis and avoid conflicts with GitHub's default settings, the following repository configurations are required:
+
+1. **Enable Advanced Setup**:
+   - Go to **Settings** -> **Code security and analysis**.
+   - Under **Code scanning**, locate **CodeQL analysis**.
+   - If "Default" is enabled, click the three dots (...) and select **Switch to advanced**.
+2. **Disable Default Setup**:
+   - The "Default" setup must be disabled for the custom workflow to upload results successfully.
+3. **Custom Workflow Dependencies**:
+   - Our custom workflow is designed to install specific project dependencies and perform a manual build before the analysis. This ensures that CodeQL has a complete build graph for the cgo/Go sources in this repository.
+
+*Note: If the Default setup is active, GitHub may reject the results uploaded by the manual workflow, causing the CI job to fail.*