diff --git a/.github/workflows/php-standards.yml b/.github/workflows/php-standards.yml
new file mode 100644
index 0000000..091d2b9
--- /dev/null
+++ b/.github/workflows/php-standards.yml
@@ -0,0 +1,54 @@
+name: PHP Code Quality
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '**.php'
+      - 'phpcs.xml'
+      - 'composer.json'
+      - 'composer.lock'
+  pull_request:
+    types:
+      - opened
+      - reopened
+      - synchronize
+      - ready_for_review
+    # Only run when PHP or the coding standards configuration change.
+    paths:
+      - '**.php'
+      - 'phpcs.xml'
+      - 'composer.json'
+      - 'composer.lock'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  phpcs:
+    name: PHPCS
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        with:
+          php-version: '8.2'
+          coverage: none
+          tools: cs2pr
+
+      - name: Install Composer dependencies
+        run: composer install --no-progress --no-interaction --no-ansi
+
+      - name: Run PHPCS
+        id: phpcs
+        run: composer lint -- --report-full --report-checkstyle=phpcs-report.xml
+
+      - name: Annotate PR with PHPCS results
+        if: ${{ always() && steps.phpcs.outcome == 'failure' }}
+        run: cs2pr ./phpcs-report.xml
diff --git a/composer.json b/composer.json
index 599440d..531f32c 100644
--- a/composer.json
+++ b/composer.json
@@ -5,11 +5,23 @@
 	"require": {
 		"composer/installers": "^1 || ^2"
 	},
+	"require-dev": {
+		"humanmade/coding-standards": "^2.3"
+	},
 	"license": "GPL-2.0-or-later",
 	"authors": [
 		{
 			"name": "Human Made Limited",
 			"email": "engineering@humanmade.com"
 		}
-	]
+	],
+	"scripts": {
+		"lint": "phpcs"
+	},
+	"config": {
+		"allow-plugins": {
+			"composer/installers": true,
+			"dealerdirect/phpcodesniffer-composer-installer": true
+		}
+	}
 }
diff --git a/inc/query-presets.php b/inc/query-presets.php
index c211bf0..fa28f0c 100644
--- a/inc/query-presets.php
+++ b/inc/query-presets.php
@@ -36,7 +36,7 @@ function register_query_preset( string $name, string $label, callable $callback
 			sprintf(
 				/* translators: %s: preset name */
 				esc_html__( 'Query preset "%s" is already registered.', 'hm-query-loop' ),
-				$name
+				esc_attr( $name )
 			),
 			'1.0.0'
 		);
diff --git a/phpcs.xml b/phpcs.xml
new file mode 100644
index 0000000..d8f25ae
--- /dev/null
+++ b/phpcs.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0"?>
+<ruleset name="HM Query Loop">
+	<description>PHPCS config for the HM Query Loop plugin</description>
+
+	<rule ref="HM-Minimum" />
+
+	<!-- PHPCompatibility 9.x errors out if this is unset. -->
+	<config name="testVersion" value="8.3-" />
+
+	<file>.</file>
+
+	<exclude-pattern>/build/*</exclude-pattern>
+	<exclude-pattern>/src/*</exclude-pattern>
+	<exclude-pattern>/node_modules/*</exclude-pattern>
+	<exclude-pattern>/tests/*</exclude-pattern>
+	<exclude-pattern>/vendor/*</exclude-pattern>
+
+	<arg name="extensions" value="php" />
+	<arg name="colors" />
+	<arg value="sp" />
+</ruleset>