diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 000000000..487ce13a6
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,11 @@
+name: "wolfTPM CodeQL config"
+
+# Disable cpp/path-injection repo-wide. It only fires on the example CLI
+# tools, where a --file argument typed by the operator running the demo
+# reaches fopen() -- the operator already owns their filesystem, so there is
+# no trust boundary. wolfTPM library code never builds a path from untrusted
+# input, so turning this one query off loses no real coverage; every other
+# security query still runs on src/.
+query-filters:
+  - exclude:
+      id: cpp/path-injection
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index d7a7b885f..dd9bef4d9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -51,6 +51,7 @@ jobs:
           # "security-and-quality" pack also flags maintainability nits (long
           # functions, comment density), which we intentionally exclude here.
           queries: security-extended
+          config-file: ./.github/codeql/codeql-config.yml
 
       - name: Build wolfTPM
         run: |