diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index afbd146d6e0..162092156ee 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -25,6 +25,8 @@ jobs:
         java: [11, 25]
     steps:
       - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0  # SonarQube needs full git history
       - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v5
         with:
@@ -34,12 +36,12 @@ jobs:
       - name: Build
         run: mvn clean install -T1C -Pminify --batch-mode --show-version
       - name: Sonar Cloud
-        if: github.repository == 'primefaces/primefaces' && github.ref == 'refs/heads/master' && matrix.java == 25
-        run: mvn clean org.jacoco:jacoco-maven-plugin:prepare-agent install org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Pquick -Dsonar.organization=primefaces -Dsonar.host.url=https://sonarcloud.io -Dsonar.token=${{secrets.SONAR_TOKEN}} -fprimefaces/pom.xml
+        if: github.repository == 'primefaces/primefaces' && (github.ref == 'refs/heads/master' || github.event_name == 'pull_request') && matrix.java == 25 && github.actor != 'dependabot[bot]'
+        run: mvn clean org.jacoco:jacoco-maven-plugin:prepare-agent install org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Pquick --file primefaces/pom.xml
         # new approach with code-coverage does not work as of 2024/12 because
         # "Failed to execute goal org.sonarsource.scanner.maven:sonar-maven-plugin:4.0.0.4121:sonar (default-cli) on project primefaces-parent: Could not find a default branch for project with key 'org.primefaces:primefaces-parent'. Make sure project exists. -> [Help 1]"
         # setting sonar.skip=true in the parent-pom.xml does not work either because this results in skipping the whole project, setting sonar.skip=false for modules does not compensate for this
-        # run: mvn clean install sonar:sonar -Pintegration-tests,parallel-execution,headless,chrome,theme-saga,csp,mojarra-4.0 -Dsonar.organization=primefaces -Dsonar.host.url=https://sonarcloud.io -Dsonar.token=${{secrets.SONAR_TOKEN}}
+        # run: mvn clean install sonar:sonar -Pintegration-tests,parallel-execution,headless,chrome,theme-saga,csp,mojarra-4.0 -Dsonar.organization=primefaces -Dsonar.host.url=https://sonarcloud.io -Dsonar.token=******
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/pom.xml b/pom.xml
index 891cb79bfa9..ca55fcd09fc 100644
--- a/pom.xml
+++ b/pom.xml
@@ -78,7 +78,6 @@
         <slf4j.version>2.0.17</slf4j.version>
 
         <sonar.skip>true</sonar.skip>
-        <sonar.coverage.jacoco.xmlReportPaths>../primefaces-coverage/target/site/jacoco-aggregate/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
 
         <npm.token/>
         <npm.username/>
@@ -151,6 +150,11 @@
                     <artifactId>maven-shade-plugin</artifactId>
                     <version>3.6.1</version>
                 </plugin>
+                <plugin>
+                    <groupId>org.sonarsource.scanner.maven</groupId>
+                    <artifactId>sonar-maven-plugin</artifactId>
+                    <version>5.5.0.6356</version>
+                </plugin>
             </plugins>
         </pluginManagement>
         <plugins>
diff --git a/primefaces/pom.xml b/primefaces/pom.xml
index ca9afa4e24f..35fc93ecbbf 100644
--- a/primefaces/pom.xml
+++ b/primefaces/pom.xml
@@ -26,7 +26,14 @@
         <yarn.version>v1.22.22</yarn.version>
         <frontend.directory>${basedir}/src/main/frontend</frontend.directory>
         <frontend.node.env>development</frontend.node.env>
+
+        <!-- SonarQube configuration -->
         <sonar.skip>false</sonar.skip>
+        <sonar.projectKey>org.primefaces:primefaces</sonar.projectKey>
+        <sonar.projectName>PrimeFaces</sonar.projectName>
+        <sonar.organization>org.primefaces</sonar.organization>
+        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
+        <sonar.coverage.jacoco.xmlReportPaths>../primefaces-coverage/target/site/jacoco-aggregate/jacoco.xml</sonar.coverage.jacoco.xmlReportPaths>
     </properties>
 
     <dependencies>