diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 514e967..4d46f10 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -37,6 +37,7 @@ jobs:
 
   codeql:
     name: CodeQL
+    if: github.event.repository.private == false
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
diff --git a/docs/ci.md b/docs/ci.md
index 3525ff6..0578e07 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -40,6 +40,8 @@ Jobs:
 - `CodeQL`: static analysis for Go.
 - `Dependency review`: reviews dependency changes on pull requests.
 
+`CodeQL` runs while the repository is public. During private stabilization phases, the job is skipped unless code scanning is enabled for the private repository in GitHub settings.
+
 `Dependency review` is advisory while the repository dependency graph is unavailable. It remains visible in the Security workflow, but the Stage 1 protected merge gate is `All CI checks`.
 
 ## Contributor Acknowledgement Workflow
diff --git a/docs_test.go b/docs_test.go
index e80d937..69c41d2 100644
--- a/docs_test.go
+++ b/docs_test.go
@@ -8,10 +8,10 @@ import (
 
 func TestDocumentationCoversInstallationUsageAndExamples(t *testing.T) {
 	files := map[string]string{
-		"README.md":               mustReadFile(t, "README.md"),
-		"docs/installation.md":    mustReadFile(t, "docs/installation.md"),
-		"docs/usage.md":           mustReadFile(t, "docs/usage.md"),
-		"examples/README.md":      mustReadFile(t, "examples/README.md"),
+		"README.md":                mustReadFile(t, "README.md"),
+		"docs/installation.md":     mustReadFile(t, "docs/installation.md"),
+		"docs/usage.md":            mustReadFile(t, "docs/usage.md"),
+		"examples/README.md":       mustReadFile(t, "examples/README.md"),
 		"examples/library/main.go": mustReadFile(t, "examples/library/main.go"),
 	}
 
@@ -44,4 +44,3 @@ func assertContains(t *testing.T, text, expected string) {
 		t.Fatalf("documentation missing %q", expected)
 	}
 }
-
diff --git a/examples/library/main.go b/examples/library/main.go
index e116f28..059f7ce 100644
--- a/examples/library/main.go
+++ b/examples/library/main.go
@@ -29,4 +29,3 @@ func main() {
 		fmt.Printf("%s: %s\n", finding.ID, finding.ReproduceCommand)
 	}
 }
-