diff --git a/.github/workflows/agent-shield.yml b/.github/workflows/agent-shield.yml
new file mode 100644
index 00000000..ab29ac82
--- /dev/null
+++ b/.github/workflows/agent-shield.yml
@@ -0,0 +1,21 @@
+# Agent Shield — thin caller that delegates to the org-level reusable workflow.
+# All logic is maintained centrally in agent-shield-reusable.yml.
+# Standard: https://github.com/petry-projects/.github/blob/main/standards/ci-standards.md#required-workflows
+name: Agent Shield
+
+on:
+  pull_request:
+    branches: [main]
+    types: [opened, reopened, synchronize]
+  push:
+    branches: [main]
+
+permissions: {}
+
+jobs:
+  agent-shield:
+    uses: petry-projects/.github/.github/workflows/agent-shield-reusable.yml@main
+    secrets: inherit
+    permissions:
+      contents: read
+      pull-requests: read