diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..74c959c3
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,6 @@
+name: Shelfmark CodeQL configuration
+
+# Test code only runs in CI and the e2e docker stack (mock servers, URL asserts), so its
+# findings are noise. Skipping it drops those alerts without hiding anything in the app.
+paths-ignore:
+  - tests
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 611bb0fc..4fe12867 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,6 +28,7 @@ jobs:
         uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
         with:
           languages: ${{ matrix.language }}
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v3