diff --git a/.github/workflows/zz-planted-test.yml b/.github/workflows/zz-planted-test.yml
new file mode 100644
index 00000000000..24dc304a323
--- /dev/null
+++ b/.github/workflows/zz-planted-test.yml
@@ -0,0 +1,14 @@
+# TEST ONLY: deliberately vulnerable workflow to check that CodeQL flags it on a PR.
+name: planted-test
+on:
+  pull_request_target:
+permissions:
+  contents: write
+jobs:
+  build:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+      - run: ./.ci/scripts/build.sh