diff --git a/.github/workflow-config.json b/.github/workflow-config.json
new file mode 100644
index 00000000..cacb8dee
--- /dev/null
+++ b/.github/workflow-config.json
@@ -0,0 +1,8 @@
+{
+  "sca_scanning": {
+    "fossa": {
+      "policy": { "mode": "REPORT" },
+      "vulnerability": { "mode": "REPORT" }
+    }
+  }
+}
diff --git a/.github/workflows/sca-scan-and-guard.yml b/.github/workflows/sca-scan-and-guard.yml
new file mode 100644
index 00000000..b0e3dc84
--- /dev/null
+++ b/.github/workflows/sca-scan-and-guard.yml
@@ -0,0 +1,70 @@
+name: SCA Scan on merge to main
+on:
+  push:
+    branches: [master]
+
+permissions:
+  contents: read
+  id-token: write
+  packages: read
+  actions: read
+  statuses: write
+  checks: write
+  pull-requests: write
+
+jobs:
+  sca_scan:
+    strategy:
+      matrix:
+        include:
+          - path: solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder
+            name: solace-spring-cloud-stream-binder
+          - path: solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder-core
+            name: solace-spring-cloud-stream-binder-core
+          - path: solace-spring-cloud-stream-binder-opentelemetry/solace-spring-cloud-stream-binder-instrumentation
+            name: solace-spring-cloud-stream-binder-instrumentation
+    uses: SolaceDev/solace-public-workflows/.github/workflows/sca-scan-and-guard.yaml@main
+    with:
+      config_file: '.github/workflow-config.json'
+      additional_scan_params: |
+        fossa.only_path=${{ matrix.path }}
+    secrets:
+      FOSSA_API_KEY: ${{ secrets.FOSSA_API_KEY }}
+
+  update_manifest:
+    needs: sca_scan
+    if: needs.sca_scan.result == 'success' && github.ref_name == github.event.repository.default_branch
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - name: solace-spring-cloud-stream-binder
+          - name: solace-spring-cloud-stream-binder-core
+          - name: solace-spring-cloud-stream-binder-instrumentation
+    permissions:
+      id-token: write
+      contents: read
+      packages: read
+    steps:
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        with:
+          role-to-assume: arn:aws:iam::868978040651:role/github-solace-cloud-manifest-rw
+          aws-region: us-east-1
+
+      - name: Update solace-cloud-manifest
+        uses: SolaceDev/solace-public-workflows/.github/actions/cicd-helper@main
+        with:
+          rc_step: add_item_from_json_to_dynamodb_table
+          ddb_table_name: solace-cloud-manifest
+          ddb_partition_key: squad
+          ddb_sort_key: repository
+          ddb_item_to_be_added: |
+            {
+              "squad": "temp",
+              "repository": "${{ matrix.name }}",
+              "dev": {
+                "sha": "${{ github.sha }}",
+                "version": "${{ github.ref_name }}"
+              }
+            }
diff --git a/solace-spring-cloud-stream-binder-opentelemetry/solace-spring-cloud-stream-binder-instrumentation/.fossa.yml b/solace-spring-cloud-stream-binder-opentelemetry/solace-spring-cloud-stream-binder-instrumentation/.fossa.yml
new file mode 100644
index 00000000..c0ebc1a1
--- /dev/null
+++ b/solace-spring-cloud-stream-binder-opentelemetry/solace-spring-cloud-stream-binder-instrumentation/.fossa.yml
@@ -0,0 +1,21 @@
+version: 3
+project:
+  locator: SolaceProducts_solace-spring-cloud-stream-binder-instrumentation
+  id: SolaceProducts_solace-spring-cloud-stream-binder-instrumentation
+  name: solace-spring-cloud-stream-binder-instrumentation
+  teams: []
+  labels:
+    - java
+vendoredDependencies:
+  forceRescans: false
+  scanMethod: CLILicenseScan
+  licenseScanPathFilters:
+    exclude:
+      - "./.git"
+      - "./.github"
+paths:
+  exclude:
+    - ./.git
+    - ./.github
+telemetry:
+  scope: full
diff --git a/solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder-core/.fossa.yml b/solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder-core/.fossa.yml
new file mode 100644
index 00000000..599e38c0
--- /dev/null
+++ b/solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder-core/.fossa.yml
@@ -0,0 +1,21 @@
+version: 3
+project:
+  locator: SolaceProducts_solace-spring-cloud-stream-binder-core
+  id: SolaceProducts_solace-spring-cloud-stream-binder-core
+  name: solace-spring-cloud-stream-binder-core
+  teams: []
+  labels:
+    - java
+vendoredDependencies:
+  forceRescans: false
+  scanMethod: CLILicenseScan
+  licenseScanPathFilters:
+    exclude:
+      - "./.git"
+      - "./.github"
+paths:
+  exclude:
+    - ./.git
+    - ./.github
+telemetry:
+  scope: full
diff --git a/solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder/.fossa.yml b/solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder/.fossa.yml
new file mode 100644
index 00000000..74b88f6d
--- /dev/null
+++ b/solace-spring-cloud-stream-binder/solace-spring-cloud-stream-binder/.fossa.yml
@@ -0,0 +1,21 @@
+version: 3
+project:
+  locator: SolaceProducts_solace-spring-cloud-stream-binder
+  id: SolaceProducts_solace-spring-cloud-stream-binder
+  name: solace-spring-cloud-stream-binder
+  teams: []
+  labels:
+    - java
+vendoredDependencies:
+  forceRescans: false
+  scanMethod: CLILicenseScan
+  licenseScanPathFilters:
+    exclude:
+      - "./.git"
+      - "./.github"
+paths:
+  exclude:
+    - ./.git
+    - ./.github
+telemetry:
+  scope: full