diff --git a/.github/workflows/release-snapshot.yml b/.github/workflows/release-snapshot.yml
index 019762d4e9..79798b776f 100644
--- a/.github/workflows/release-snapshot.yml
+++ b/.github/workflows/release-snapshot.yml
@@ -6,6 +6,7 @@ on:
       - "main"
       - "demo-*"
       - "bugbash-*"
+      - "eval-*"
 
   # Confirm that snapshot builds work if this file is modified.
   pull_request:
diff --git a/.github/workflows/scan-snapshot.yml b/.github/workflows/scan-snapshot.yml
new file mode 100644
index 0000000000..34fc2a3e94
--- /dev/null
+++ b/.github/workflows/scan-snapshot.yml
@@ -0,0 +1,66 @@
+name: scan-snapshot
+
+on:
+  push:
+    branches:
+      - "eval-*"
+
+  workflow_dispatch:
+
+jobs:
+  download:
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    steps:
+      - name: Download snapshot release assets
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release download snapshot --repo ${{ github.repository }} --pattern '*.tar.gz' --dir dist
+
+      - name: Upload macOS binaries
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: cli_darwin_snapshot
+          path: dist/*darwin*
+
+      - name: Upload Linux binaries
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: cli_linux_snapshot
+          path: dist/*linux*
+
+      - name: Upload Windows binaries
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: cli_windows_snapshot
+          path: dist/*windows*
+
+  scan:
+    needs: download
+    runs-on:
+      group: databricks-deco-testing-runner-group
+      labels: ubuntu-latest-deco
+
+    strategy:
+      matrix:
+        artifact:
+          - cli_darwin_snapshot
+          - cli_linux_snapshot
+          - cli_windows_snapshot
+
+    steps:
+      - name: Checkout scan action
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          repository: databricks/gh-action-scan
+          ref: 3599451f16bfeaecaf4fc7dc0853bcd6d89e9ea1
+          path: .gh-action-scan
+
+      - name: Scan artifact
+        uses: ./.gh-action-scan
+        with:
+          download-artifact: ${{ matrix.artifact }}
+          artifact-name: ${{ matrix.artifact }}