diff --git a/.github/codeql/rust-extractor.yaml b/.github/codeql/rust-extractor.yaml
new file mode 100644
index 0000000..5975d1a
--- /dev/null
+++ b/.github/codeql/rust-extractor.yaml
@@ -0,0 +1,4 @@
+name: rust-extractor
+version: 1.0.0
+options:
+  cargo_target: x86_64-unknown-uefi
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 4c55dc4..6f226cc 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -8,6 +8,9 @@ on:
   schedule:
   - cron: '33 16 * * 0'
 
+permissions:
+  contents: read # Needed to checkout the repository.
+
 jobs:
   analyze:
     name: analyze (${{ matrix.language }})
@@ -16,7 +19,7 @@ jobs:
       security-events: write # Needed to upload results.
       packages: read # Needed to fetch internal or private CodeQL packs.
       actions: read # Needed to read workflows.
-      contents: read # Needed to read code.
+      contents: read # Needed to checkout the repository.
 
     strategy:
       fail-fast: false
@@ -37,6 +40,10 @@ jobs:
       with:
         persist-credentials: false
 
+    - name: use rust extractor config
+      run: |
+        echo "CODEQL_EXTRACTOR_RUST_CONFIG=.github/codeql/rust-extractor.yaml" >> $GITHUB_ENV
+
     - name: initialize codeql
       uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 #v4
       with: