diff --git a/test-and-deploy.yml b/test-and-deploy.yml
index 2fd261ac45331444aa39160491f65c67ec62d537..e6573758284d92fd3d06fc71fa84a9732e144f5a 100644
--- a/test-and-deploy.yml
+++ b/test-and-deploy.yml
@@ -200,6 +200,10 @@ Debug:
     # Run the following twice to ensure new patches get applied.
     - composer install --no-interaction --no-progress --no-dev
     - composer install --no-interaction --no-progress --no-dev
+    # Add the Drupal Vendor Hardening Composer Plugin.
+    # see https://github.com/drupal/core-vendor-hardening
+    - composer config --no-interaction allow-plugins.drupal/core-vendor-hardening true
+    - composer require --no-interaction --no-progress drupal/core-vendor-hardening
   artifacts:
     name: build-prod
     when: always