diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 1d0dae2dc..256c769d1 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -32,6 +32,9 @@ extends:
         enabled: true
       binskim:
         enabled: true
+      codeql:
+        ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/release/') }}:
+          enabledOnNonDefaultBranches: true
     pool:
       name: $(DncEngInternalBuildPool)
       image: 1es-windows-2022