diff --git a/.github/.sbomber-manifest.yaml b/.github/.sbomber-manifest.yaml
new file mode 100644
index 0000000..28fa058
--- /dev/null
+++ b/.github/.sbomber-manifest.yaml
@@ -0,0 +1,28 @@
+clients:
+  sbom:
+    service_url: https://sbom-request.canonical.com
+    department: charm_engineering
+    email: tony.meyer@canonical.com
+    team: charm_tech
+  secscan: {}
+
+artifacts:
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@18.04
+
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@20.04
+
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@22.04
+
+  - name: ubuntu
+    type: charm
+    channel: '2.x/stable'
+    base: ubuntu@24.04
diff --git a/.github/workflows/sbom-secscan.yaml b/.github/workflows/sbom-secscan.yaml
new file mode 100644
index 0000000..4c2469d
--- /dev/null
+++ b/.github/workflows/sbom-secscan.yaml
@@ -0,0 +1,25 @@
+name: SBOM and secscan
+
+on:
+  workflow_dispatch:
+  schedule:
+    # Run on the 10th of April and October, aligned to the Canonical release cycle.
+    - cron: "0 0 10 4,10 *"
+
+permissions: {}
+
+jobs:
+  scan:
+    name: SBOM and secscan
+    runs-on: [self-hosted, self-hosted-linux-amd64-jammy-private-endpoint-medium]
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          persist-credentials: false
+
+      - name: sbomber
+        uses: canonical/sbomber/.github/actions/run@cf7a76e810497ec932e8285b2c9d6b373d225e79  # main -- the sbomber-ref input below should match
+        with:
+          manifest: ${{ github.workspace }}/.github/.sbomber-manifest.yaml
+          artifact-name: secscan-report-upload
+          sbomber-ref: cf7a76e810497ec932e8285b2c9d6b373d225e79  # should match the ref in 'uses' above