diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d4f108c..391f6bf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -14,6 +14,10 @@ permissions:
 
 jobs:
   analyze:
+    # GitHub code scanning is unavailable for private repositories without GHAS.
+    # Keeping the workflow dormant here makes it take effect automatically if
+    # the repository is made public later.
+    if: github.event.repository.visibility == 'public'
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7