diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1e3207..455cc8a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,13 +35,29 @@ jobs:
       - name: Install dependencies
         run: |
           python -m pip install --upgrade pip
-          pip install -r requirements-dev.txt
+          pip install flake8
       - name: Run Flake8
         run: flake8 .
 
+  lint-bandit:
+    name: Lint (Bandit)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.10'
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install bandit
+      - name: Run Bandit
+        run: bandit -r . -ll
+
   test-linux:
     name: Test (Linux)
-    needs: [lint-ruff, lint-flake8]
+    needs: [lint-ruff, lint-flake8, lint-bandit]
     runs-on: ubuntu-latest
     strategy:
       matrix:
@@ -63,7 +79,7 @@ jobs:
 
   test-windows:
     name: Test (Windows)
-    needs: [lint-ruff, lint-flake8]
+    needs: [lint-ruff, lint-flake8, lint-bandit]
     runs-on: windows-latest
     strategy:
       matrix:
@@ -85,7 +101,7 @@ jobs:
 
   test-macos:
     name: Test (macOS)
-    needs: [lint-ruff, lint-flake8]
+    needs: [lint-ruff, lint-flake8, lint-bandit]
     runs-on: macos-latest
     strategy:
       matrix:
diff --git a/requirements-dev.txt b/requirements-dev.txt
index 22b032b..b57e206 100644
--- a/requirements-dev.txt
+++ b/requirements-dev.txt
@@ -3,3 +3,4 @@ ruff
 flake8
 build
 twine
+bandit