diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index e2551beb..16dab0b6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -37,6 +37,16 @@ jobs:
           artifactory-deployer-role: qa-deployer
           use-develocity: true
           develocity-url: https://develocity-public.sonar.build/
+          sonar-platform: none
+          maven-args: -Pcoverage
+
+      - name: Upload plugin build as pipeline artifact
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: build-output-${{ steps.build.outputs.BUILD_NUMBER }}
+          path: '**/target'
+          retention-days: 7
+          overwrite: true
 
       - name: Prepare PVF candidate version
         if: ${{ steps.build.outputs.deployed }}
@@ -44,6 +54,38 @@ jobs:
         with:
           build-version: ${{ steps.build.outputs.project-version }}
 
+  analysis:
+    name: NEXT analysis
+    needs: build
+    # Match build-maven's should_scan policy; other refs only build and deploy.
+    if: >-
+      github.event_name == 'pull_request' ||
+      github.ref_name == github.event.repository.default_branch ||
+      startsWith(github.ref_name, 'branch-') ||
+      startsWith(github.ref_name, 'feature/long/')
+    runs-on: github-ubuntu-latest-m
+    permissions:
+      id-token: write
+      contents: read
+    env:
+      BUILD_NUMBER: ${{ needs.build.outputs.build-number }}
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: jdx/mise-action@7a4e45a543138629540c9a1616d08632b893e492 # v5.0.1
+        with:
+          version: 2026.10.0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-output-${{ needs.build.outputs.build-number }}
+      - uses: SonarSource/ci-github-actions/build-maven@v2
+        with:
+          deploy: false
+          skip-build: true
+          sonar-platform: next
+          artifactory-reader-role: private-reader
+          use-develocity: true
+          develocity-url: https://develocity-public.sonar.build/
+
   build-win:
     name: Build Windows
     needs:
@@ -149,9 +191,16 @@ jobs:
   promote:
     needs:
       - build
+      - analysis
       - build-win
       - qa
-    if: ${{ needs.build.outputs.deployed }}
+    if: >-
+      !cancelled()
+      && needs.build.result == 'success'
+      && needs.build-win.result == 'success'
+      && needs.qa.result == 'success'
+      && (needs.analysis.result == 'success' || needs.analysis.result == 'skipped')
+      && (needs.build.outputs.deployed)
     runs-on: github-ubuntu-latest-s  # Custom GitHub-hosted runner for public repos
     name: Promote
     permissions:
@@ -165,7 +214,7 @@ jobs:
           promote-pull-request: true
 
   notify-build-failure:
-    needs: [build, build-win, qa, promote]
+    needs: [build, analysis, build-win, qa, promote]
     if: >-
       always()
       && (github.ref_name == github.event.repository.default_branch || startsWith(github.ref, 'refs/heads/branch-') || startsWith(github.ref, 'refs/heads/dogfood-'))