diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 7798cdf..0000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,34 +0,0 @@
-name: CodeQL
-
-on:
-  push:
-    branches: [main]
-  pull_request:
-    branches: [main]
-  schedule:
-    - cron: "17 4 * * 1"
-  workflow_dispatch:
-
-permissions:
-  contents: read
-  security-events: write
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  analyze:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    steps:
-      - name: Check out repository
-        uses: actions/checkout@v4
-
-      - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
-        with:
-          languages: python
-
-      - name: Analyze
-        uses: github/codeql-action/analyze@v3
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d133dfb..4541b28 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- CodeQL runs through the GitHub default setup only; the own workflow `.github/workflows/codeql.yml` is removed (T-20261107-558181168) on 2026-11-07:
+  - The repository has the GitHub default setup for code scanning (python and actions, weekly, default query suite, configured since 2026-07-22). The workflow from 2026-10-30 was a second, "advanced" configuration, and its `analyze` job failed on every run (push, pull request, schedule) with "advanced configurations cannot be processed when the default setup is enabled". The default setup already covers Python and GitHub Actions; no coverage is lost.
+  - `tests/test_metadata.py`: the contract test that required the workflow now forbids it and any `github/codeql-action` step. To switch to an advanced setup later, change the repository setting first and add the workflow in the same step.
+
 - Automation control no longer hides unreadable `automation.toml` files and writes them atomically (T-20261101-844031160) on 2026-11-07:
   - Unreadable definitions are reported, not skipped: `scan_automations()` returns them next to the readable records (`UnparseableAutomation`: folder name, path, error text), `find_automation_anomalies()` has a new `unparseable` category, and `diagnose()` lists them in the report (`unparseable_automations`, shown by `to_text()`) without a new issue code, so the public health exchange contract v1 stays unchanged. `load_automations()` keeps its signature and still returns only the readable records. This matters for the duplicate `model`/`reasoning_effort` keys of 2026-10-31, which tomlkit rejects as `ParseError`: 94 of 113 files would have been invisible to pause, restore and the anomaly check.
   - Pause, restore and activate-all list every unreadable definition (folder, path, error) in `errors` and in the new `unparseable_ids`, so `status` is never `ok` and the tray and the orchestrator show it as partial or failed. IDs that CareCenter paused earlier stay remembered while their file is unreadable; an unreadable file CareCenter never paused is not adopted, so a later restore cannot activate something the user paused.
diff --git a/tests/test_metadata.py b/tests/test_metadata.py
index e227834..13e348e 100644
--- a/tests/test_metadata.py
+++ b/tests/test_metadata.py
@@ -844,15 +844,16 @@ def test_dependabot_actions_and_pip_guard() -> None:
     assert "open-pull-requests-limit: 3" in content
 
 
-def test_codeql_concurrency_guardrail() -> None:
-    """Verify .github/workflows/codeql.yml defines concurrency and least-privilege permissions."""
-    codeql_path = ROOT / ".github" / "workflows" / "codeql.yml"
-    assert codeql_path.is_file(), "codeql.yml must exist"
-    content = codeql_path.read_text(encoding="utf-8")
-    assert "concurrency:" in content
-    assert "cancel-in-progress: true" in content
-    assert "security-events: write" in content
-    assert "languages: python" in content
+def test_codeql_runs_through_the_github_default_setup_only() -> None:
+    """Das Repo nutzt das GitHub-Default-Setup fuer Code-Scanning (python, actions, woechentlich).
+
+    Ein eigener CodeQL-Workflow waere eine zweite Konfiguration und liesse den Check ``analyze`` bei jedem
+    Lauf scheitern ("advanced configurations cannot be processed when the default setup is enabled").
+    """
+    workflows = ROOT / ".github" / "workflows"
+    assert not (workflows / "codeql.yml").exists(), "codeql.yml doppelt die Default-Konfiguration"
+    for workflow in sorted(workflows.glob("*.y*ml")):
+        assert "github/codeql-action/" not in workflow.read_text(encoding="utf-8"), workflow.name
 
 
 def test_pep621_maintainers_and_classifiers() -> None: