diff --git a/debian/rules b/debian/rules
index b874c251f8a7583566d505303168aadd9e597844..d9350df991dc6aa3298f52a93d7d0df695ad5b60 100755
--- a/debian/rules
+++ b/debian/rules
@@ -38,6 +38,13 @@ DH_BUILD_OPTS= --sourcedir=src --builddir=build
 
 build: build-arch build-indep
 
+execute_before_dh_auto_build:
+	# It's fine for a test program not to get some of the hardening flags because
+	# it is never installed
+	@echo 'blhc: ignore-line-regexp: .* -o t_trval .*'
+	# It's not a problem that fortify flags are absent when preprosessor creates
+	# version identifier in docs
+	@echo 'blhc: ignore-line-regexp: .*doc/version.py'
 
 override_dh_auto_configure:
 	dh_auto_configure $(DH_BUILD_OPTS) -- --with-system-et --with-system-ss --disable-rpath  \
diff --git a/debian/salsa-ci.yml b/debian/salsa-ci.yml
new file mode 100644
index 0000000000000000000000000000000000000000..ce5b6699c794ece6dae6a9b5b17fea823d1dce60
--- /dev/null
+++ b/debian/salsa-ci.yml
@@ -0,0 +1,14 @@
+---
+include:
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/salsa-ci.yml
+  - https://salsa.debian.org/salsa-ci-team/pipeline/raw/master/pipeline-jobs.yml
+
+# Disable failing reprotest. If needs more investigation and fixing before it
+# can be enabled.
+variables:
+  SALSA_CI_DISABLE_REPROTEST: 1
+
+# If Salsa-CI is not running at
+# https://salsa.debian.org/%{project_path}/-/pipelines, ensure that
+# https://salsa.debian.org/%{project_path}/-/settings/ci_cd has in field "CI/CD
+# configuration file" filename "debian/salsa-ci.yml"