diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
deleted file mode 100644
index d835264a7..000000000
--- a/.github/workflows/sonar.yml
+++ /dev/null
@@ -1,64 +0,0 @@
----
-name: Sonar
-
-"on":
-  pull_request:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
-
-env:
-  CARGO_TERM_COLOR: always
-
-jobs:
-  sonar:
-    name: SonarQube scan
-    runs-on: ubuntu-26.04
-    timeout-minutes: 45
-    # Neither a fork's pull request nor a Dependabot run can read SONAR_TOKEN,
-    # so the scan runs for same-repo human branches and pushes to main only.
-    if: >-
-      github.event_name == 'push' ||
-      (github.event.pull_request.head.repo.full_name == github.repository &&
-      github.event.pull_request.user.login != 'dependabot[bot]')
-    steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-        with:
-          # Full history improves blame-based new-code attribution.
-          fetch-depth: 0
-          # Later steps never talk to git, so keep the token out of git config.
-          persist-credentials: false
-
-      - name: Cache cargo downloads
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
-        with:
-          path: |
-            ~/.cargo/registry/index
-            ~/.cargo/registry/cache
-            ~/.cargo/git/db
-          key: dl-${{ runner.os }}-${{ hashFiles('**/Cargo.lock') }}
-          restore-keys: |
-            dl-${{ runner.os }}-
-
-      - name: Install stable clippy
-        run: |
-          rustup toolchain install stable \
-            --profile minimal \
-            --component clippy
-
-      - name: Clippy report
-        # Token-free clippy run. The scan step only imports this report, so
-        # SONAR_TOKEN never reaches dependency build scripts or proc macros.
-        run: cargo clippy --message-format=json > clippy-report.json
-
-      - name: SonarQube scan
-        uses: SonarSource/sonarqube-scan-action@d209202bc7d53ff1cc128f7f907dac145c9d6ae9 # v8.3.0
-        env:
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/sonar-project.properties b/sonar-project.properties
deleted file mode 100644
index 5c4555f05..000000000
--- a/sonar-project.properties
+++ /dev/null
@@ -1,18 +0,0 @@
-# SonarQube Cloud analysis configuration. The organization and project keys
-# come from the SonarQube Cloud project import and must match it exactly.
-sonar.organization=lucacappelletti94-github
-sonar.projectKey=LucaCappelletti94_sqlite-diff-rs
-sonar.projectName=sqlite-diff-rs
-
-# tests/ trees carry the test scope. Inline #[cfg(test)] modules stay
-# classified as sources, which is the Rust reality. The source exclusion
-# keeps the two scopes disjoint, which the scanner requires.
-sonar.sources=src,benches,fuzz,compile-bench,integration-tests
-sonar.exclusions=**/target/**,**/tests/**
-sonar.tests=tests,integration-tests/diesel-e2e/tests,integration-tests/schema-aware-roundtrip/tests
-sonar.sourceEncoding=UTF-8
-
-# Clippy runs as a token-free workflow step and the scan imports its report,
-# keeping SONAR_TOKEN away from dependency build scripts and proc macros.
-sonar.rust.clippy.enabled=false
-sonar.rust.clippyReport.reportPaths=clippy-report.json