diff --git a/.github/workflows/sonarcloud.yml b/.github/workflows/sonarcloud.yml
index e78fe1ea3b..18f831645c 100644
--- a/.github/workflows/sonarcloud.yml
+++ b/.github/workflows/sonarcloud.yml
@@ -18,4 +18,7 @@ jobs:
   sonarcloud:
     # Tracked at @main so org-wide CI improvements propagate without PR churn.
     uses: storytold/craft-common-actions/.github/workflows/sonarcloud.yml@main
+    with:
+      # Match the font input used by the normal CI gate.
+      fonts-ref: 3d9ab3a132ed0eff457e424226a435a901da30d3
     secrets: inherit
diff --git a/sonar-project.properties b/sonar-project.properties
index 7d0926a248..93b285dfd3 100644
--- a/sonar-project.properties
+++ b/sonar-project.properties
@@ -1,6 +1,10 @@
 sonar.projectKey=storytold_pdfcraft
 sonar.organization=storytold
 
+# Report the server's quality gate result in the scan job.
+sonar.qualitygate.wait=true
+sonar.qualitygate.timeout=600
+
 # vendor/ holds third-party crates carried with small, marked patches (vendor/README.md).
 # They are kept close to upstream so each copy can be dropped once upstream releases the
 # fix; restyling them would only make that harder, so they are not analysed here.