diff --git a/.gitignore b/.gitignore
index cb02fead..c7ff229c 100644
--- a/.gitignore
+++ b/.gitignore
@@ -372,6 +372,7 @@ CLAUDE.local.md
 !.github/workflows/release.yml
 !.qlty/
 !.qlty/qlty.toml
+!.sonarcloud.properties
 !.vscode/settings.json
 !config/
 !config/gitleaks-release.toml
diff --git a/.sonarcloud.properties b/.sonarcloud.properties
new file mode 100644
index 00000000..eba1ee7a
--- /dev/null
+++ b/.sonarcloud.properties
@@ -0,0 +1,17 @@
+# @flext-regenerate: make gen
+# @flext-ssot: flext-infra/config/codegen.yaml + flext-infra/src/flext_infra/templates/project/base/sonarcloud.properties.j2
+# @flext-maintenance: do not edit generated projections; edit the SSOT and regenerate
+# Generated by flext_infra codegen conform.
+#
+# SonarCloud automatic analysis honors only the scope keys below.
+
+sonar.sources=.
+sonar.tests=tests
+sonar.test.inclusions=tests/**/*.py
+sonar.sourceEncoding=UTF-8
+sonar.exclusions=**/.venv/**,**/__pycache__/**,**/*.py[cod],**/build/**,**/dist/**,**/*.egg-info/**,**/.pytest_cache/**,**/.reports/**,**/node_modules/**,**/.scannerwork/**,tests/**
+sonar.cpd.exclusions=tests/**
+
+# Server-side issue exclusions: applied through SonarCloud project settings,
+# which automatic analysis requires; they are not file properties.
+#   text:S8565 on pyproject.toml: fleet lockfile ban (operator order); dependency ranges live in pyproject.toml; bead flext-c8yle