diff --git a/.github/workflows/code-ql.yml b/.github/workflows/code-ql.yml
index 4c9baad..9cbd15e 100644
--- a/.github/workflows/code-ql.yml
+++ b/.github/workflows/code-ql.yml
@@ -1,7 +1,10 @@
 name: CodeQL
 
 on:
+  push:
+    branches: [master]
   pull_request:
+    branches: [master]
   schedule:
     - cron: '0 5 * * 1'
   workflow_dispatch:
@@ -9,13 +12,16 @@ on:
 permissions: {}
 
 jobs:
-  analyze:
-    name: Analyze (rust)
+  # One job for every language, so the required check context is exactly `code-ql` (a matrix would suffix it
+  # with the language).
+  code-ql:
+    name: code-ql
     runs-on: ubuntu-latest
     permissions:
       actions: read
       contents: read
       security-events: write
+
     steps:
       - name: Checkout code
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -25,10 +31,13 @@ jobs:
       - name: Initialize CodeQL
         uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
-          languages: rust
+          languages: rust,actions
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
 
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        with:
+          # The category of the earlier `analyze` job, so the existing analyses and alerts carry over.
+          category: .github/workflows/code-ql.yml:analyze