diff --git a/.gitignore b/.gitignore
index 1f4d9e378f..55bc4ffdd4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -56,3 +56,6 @@ kyua.log
 named.memstats
 named.run
 timestamp
+/compile_commands.json
+/cppcheck_html/
+/cppcheck.results
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 041f10cd36..c985152e39 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,6 +15,8 @@ variables:
   BUILD_PARALLEL_JOBS: 6
   TEST_PARALLEL_JOBS: 6
 
+  MAKE: make
+
 stages:
   - precheck
   - build
@@ -22,6 +24,7 @@ stages:
   - system
   - docs
   - push
+  - postcheck
 
 ### Runner Tag Templates
 
@@ -162,7 +165,7 @@ stages:
     - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
   script:
     - *configure
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - ${MAKE} -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
     - test -z "${RUN_MAKE_INSTALL}" || make install
   dependencies:
     - autoreconf:sid:amd64
@@ -221,6 +224,39 @@ stages:
     expire_in: "1 week"
     when: on_failure
 
+.cppcheck_args: &run_cppcheck |
+  cppcheck --enable=warning,performance,portability,information,missingInclude \
+           --include=config.h \
+           --quiet \
+           --std=c11 \
+           --language=c \
+           --project=compile_commands.json \
+           --error-exitcode=2 \
+           -j ${TEST_PARALLEL_JOBS:-1} \
+           --xml \
+           --output-file=cppcheck.results \
+           --inline-suppr
+
+.cppcheck_report: &cppcheck_report_html |
+  cppcheck-htmlreport --title="BIND 9 ($CI_COMMIT_SHORT_SHA) Cppcheck Report" \
+                      --file=cppcheck.results \
+                      --report-dir=cppcheck_html/
+
+.cppcheck: &cppcheck_job
+  <<: *default_triggering_rules
+  stage: postcheck
+  script:
+    - *run_cppcheck
+  after_script:
+    - *cppcheck_report_html
+  artifacts:
+    paths:
+      - compile_commands.json
+      - cppcheck.results
+      - cppcheck_html/
+    expire_in: "1 week"
+    when: on_failure
+
 ### Job Definitions
 
 # Jobs in the precheck stage
@@ -437,6 +473,7 @@ gcc:sid:amd64:
     CFLAGS: "-Wall -Wextra -O3 -g"
     EXTRA_CONFIGURE: "--enable-dnstap --with-libidn2"
     RUN_MAKE_INSTALL: 1
+    MAKE: bear make
   <<: *debian_sid_amd64_image
   <<: *build_job
 
@@ -454,6 +491,13 @@ unit:gcc:sid:amd64:
     - gcc:sid:amd64
   needs: ["gcc:sid:amd64"]
 
+cppcheck:gcc:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *cppcheck_job
+  dependencies:
+    - gcc:sid:amd64
+  needs: ["gcc:sid:amd64"]
+
 # Jobs for regular GCC builds on Debian Sid (i386)
 
 gcc:sid:i386: