diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml
new file mode 100644
index 00000000..7898293e
--- /dev/null
+++ b/.github/codeql/codeql-config.yml
@@ -0,0 +1,2 @@
+data_extensions:
+  - .github/codeql/extensions/safeLog.model.yml
diff --git a/.github/codeql/extensions/safeLog.model.yml b/.github/codeql/extensions/safeLog.model.yml
new file mode 100644
index 00000000..04eec809
--- /dev/null
+++ b/.github/codeql/extensions/safeLog.model.yml
@@ -0,0 +1,6 @@
+extensions:
+  - addsTo:
+      pack: codeql/javascript-all
+      extensible: barrierModel
+    data:
+      - ["backend/src/utils/safeLog", "Member[sanitizeForLog].ReturnValue", "log-injection"]
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index da54f251..b756f9d8 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -37,6 +37,7 @@ jobs:
         with:
           languages: ${{ matrix.language }}
           queries: security-extended
+          config-file: .github/codeql/codeql-config.yml
 
       - name: Autobuild
         uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2