diff --git a/vars/sonarScan.groovy b/vars/sonarScan.groovy
new file mode 100644
index 0000000..ad329c1
--- /dev/null
+++ b/vars/sonarScan.groovy
@@ -0,0 +1,20 @@
+#!/usr/bin/env groovy
+// Run a SonarQube analysis from the scanner container.
+// Usage: sonarScan('my-project-key')
+def call(String projectKey, Map config = [:]) {
+    def host = config.host ?: 'http://10.0.1.4:9000'
+    def sources = config.sources ?: '.'
+    container('scanner') {
+        stage('SonarQube analysis') {
+            withCredentials([string(credentialsId: 'sonarqube-token', variable: 'SONAR_TOKEN')]) {
+                sh """
+                    sonar-scanner \
+                      -Dsonar.host.url=${host} \
+                      -Dsonar.projectKey=${projectKey} \
+                      -Dsonar.sources=${sources} \
+                      -Dsonar.token=\${SONAR_TOKEN}
+                """
+            }
+        }
+    }
+}