diff --git a/.github/codeql-config-js.yml b/.github/codeql-config-js.yml
new file mode 100644
index 00000000..47d5a0f8
--- /dev/null
+++ b/.github/codeql-config-js.yml
@@ -0,0 +1,19 @@
+# CodeQL configuration
+# https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning
+
+name: "JavaScript/TypeScript Security Analysis"
+
+disable-default-queries: false
+
+queries:
+  - uses: security-extended
+  - uses: security-and-quality
+
+# Paths to exclude from analysis
+paths-ignore:
+  - "**/node_modules/**"
+  # Vendored third-party libraries (preact, htm, es-module-shims), copied
+  # verbatim from npm by scripts/update-static-deps.sh. We don't modify or
+  # control their internals, so findings here aren't actionable from this
+  # repo -- report upstream instead.
+  - "pkg/service/soundtouchweb/static/lib/**"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 028c3af0..c8db5875 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -44,7 +44,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
-          config-file: ${{ matrix.language == 'go' && './.github/codeql-config.yml' || '' }}
+          config-file: ${{ matrix.language == 'go' && './.github/codeql-config.yml' || matrix.language == 'javascript-typescript' && './.github/codeql-config-js.yml' || '' }}
 
       - name: Build Go (required for manual build-mode)
         if: matrix.language == 'go'