diff --git a/services/maintenance/apps/ariadne-deployment.yaml b/services/maintenance/apps/ariadne-deployment.yaml
index 896f8cd1c..ba4fa1971 100644
--- a/services/maintenance/apps/ariadne-deployment.yaml
+++ b/services/maintenance/apps/ariadne-deployment.yaml
@@ -35,6 +35,9 @@ spec:
           export GAME_MODE_HOOK_TOKEN="{{ .Data.data.game_mode_hook_token }}"
           {{- end }}
           {{ end }}
+          {{ with secret "kv/data/atlas/quality/sonarqube-oidc" }}
+          export ARIADNE_HERMES_SONAR_TOKEN="{{ .Data.data.sonarqube_exporter_token }}"
+          {{ end }}
           {{ with secret "kv/data/atlas/portal/atlas-portal-db" }}
           export PORTAL_DATABASE_URL="{{ .Data.data.PORTAL_DATABASE_URL }}"
           {{ end }}
@@ -541,9 +544,39 @@ spec:
             # executes on its own authority, whereas everything here becomes a
             # pull request a person reads before anything changes.
             - name: ARIADNE_HERMES_FIX_CATEGORIES
-              value: lint_violation,undefined_name,failing_assertion
+              value: sonarqube_issue,lint_violation,undefined_name,failing_assertion
             - name: ARIADNE_HERMES_CODE_MAX_OPEN_PROPOSALS
               value: "64"
+            # The SonarQube sweep: the second way into the proposal flow. Triage
+            # enters on a build failure; static analysis never fails anything, so
+            # its findings would otherwise sit unread forever. From evidence
+            # collection onward the path is identical, gates included.
+            - name: ARIADNE_HERMES_SONAR_ENABLED
+              value: "true"
+            - name: ARIADNE_HERMES_SONAR_URL
+              value: http://sonarqube.quality.svc.cluster.local:9000
+            # sonar-project=jenkins-job. The job already carries the repository
+            # mapping in ARIADNE_HERMES_CODE_REPOS, so there is no second place
+            # for the two to disagree. Scoped to one project to start: this opens
+            # pull requests nobody asked for, and that is worth widening
+            # deliberately rather than by default.
+            - name: ARIADNE_HERMES_SONAR_PROJECTS
+              value: ariadne=ariadne
+            # Hotspots are absent by construction - they need human review, not a
+            # patch - so only findings with a code fix are ever requested.
+            - name: ARIADNE_HERMES_SONAR_TYPES
+              value: CODE_SMELL,BUG
+            # One per sweep, hourly. A backlog of 139 findings turned into 139
+            # pull requests would make the review gate theatre; the open-proposal
+            # ceiling above still applies on top of this.
+            - name: ARIADNE_HERMES_SONAR_MAX_PER_SWEEP
+              value: "1"
+            # SonarQube's own effort estimate is the filter, not severity: it is
+            # the closest proxy for the single anchored change the patch
+            # validator can check. Anything it calls longer than this is a
+            # refactor for a person.
+            - name: ARIADNE_HERMES_SONAR_MAX_EFFORT_MINUTES
+              value: "20"
             - name: ARIADNE_HERMES_CODE_REPOS
               value: metis=bstein/metis,lesavka=bstein/lesavka,soteria=bstein/soteria,bstein-dev-home=bstein/bstein-dev-home,ariadne=bstein/ariadne,ananke=bstein/ananke,pegasus=bstein/pegasus,atlasbot=bstein/atlasbot
             - name: ARIADNE_HERMES_CODE_BASE_BRANCHES