diff --git a/.codacy.yml b/.codacy.yml
new file mode 100644
index 0000000..0793f6b
--- /dev/null
+++ b/.codacy.yml
@@ -0,0 +1,9 @@
+# Codacy analysis scope.
+#
+# CI workflow definitions and the helper scripts they run are never
+# shipped in the published package, so findings there fail the quality
+# gate without describing any risk to users of this project. This
+# mirrors the scope already set for SonarQube Cloud in
+# .sonarcloud.properties.
+exclude_paths:
+  - ".github/**"
diff --git a/pyproject.toml b/pyproject.toml
index 5e833cb..1a93174 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -82,6 +82,9 @@ test = [
 source = "vcs"
 
 [tool.ruff]
+# CI workflow definitions and the helper scripts they run are not
+# part of the published package, so they are out of scope here.
+extend-exclude = [".github"]
 line-length = 80
 indent-width = 4
 preview = true