diff --git a/.devcontainer/docker-compose.yml b/.devcontainer/docker-compose.yml
index f10319c5..ff4d43e0 100644
--- a/.devcontainer/docker-compose.yml
+++ b/.devcontainer/docker-compose.yml
@@ -64,7 +64,7 @@ services:
     command: sleep infinity
 
   clang:
-    image: ghcr.io/davidcozens/cpputest-clang:sha-0385cea
+    image: ghcr.io/davidcozens/cpputest-clang:sha-7eac3ab
     volumes:
       - ..:/workspaces/SolidSyslog:cached
       - ${SSH_AUTH_SOCK:-/dev/null}:/ssh-agent
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad259861..c2a86973 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -108,7 +108,7 @@ jobs:
       contents: read
       checks: write
     container:
-      image: ghcr.io/davidcozens/cpputest-clang:sha-0385cea
+      image: ghcr.io/davidcozens/cpputest-clang:sha-7eac3ab
       options: --user root
     env:
       GIT_CONFIG_COUNT: 1
@@ -289,6 +289,34 @@ jobs:
           path: build/tidy/clang-tidy-output.txt
           retention-days: 1
 
+  analyze-iwyu:
+    runs-on: ubuntu-latest
+    container:
+      image: ghcr.io/davidcozens/cpputest-clang:sha-7eac3ab
+      options: --user root
+    env:
+      GIT_CONFIG_COUNT: 1
+      GIT_CONFIG_KEY_0: safe.directory
+      GIT_CONFIG_VALUE_0: '*'
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Configure
+        run: cmake --preset iwyu
+
+      - name: Run include-what-you-use
+        shell: bash
+        run: set -o pipefail && cmake --build --preset iwyu --target iwyu 2>&1 | tee build/iwyu/iwyu-output.txt
+
+      - name: Upload iwyu output
+        if: success() || failure()
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        with:
+          name: iwyu-report
+          path: build/iwyu/iwyu-output.txt
+          retention-days: 1
+
   analyze-format:
     runs-on: ubuntu-latest
     container:
@@ -549,7 +577,7 @@ jobs:
 
   summary:
     if: always() && github.event_name == 'pull_request'
-    needs: [build-linux-gcc, build-linux-clang, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-cppcheck, analyze-format, bdd-linux-syslog-ng, build-windows-msvc, bdd-windows-otel, integration-linux-openssl]
+    needs: [build-linux-gcc, build-linux-clang, sanitize-linux-gcc, coverage-linux-gcc, analyze-tidy, analyze-cppcheck, analyze-format, analyze-iwyu, bdd-linux-syslog-ng, build-windows-msvc, bdd-windows-otel, integration-linux-openssl]
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -578,6 +606,14 @@ jobs:
         with:
           name: cppcheck-report
           path: quality-reports/
+
+      - name: Download iwyu report
+        continue-on-error: true
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        with:
+          name: iwyu-report
+          path: quality-reports/
+
       - name: Quality Monitor
         uses: uhafner/quality-monitor@v1
         with:
diff --git a/docs/ci.md b/docs/ci.md
index badeba04..3947d7f4 100644
--- a/docs/ci.md
+++ b/docs/ci.md
@@ -18,6 +18,7 @@ without renaming what's already there.
 | `analyze-tidy` | `tidy` | clang-tidy — pass/fail with errors in job log |
 | `analyze-cppcheck` | `cppcheck` | cppcheck static analysis |
 | `analyze-format` | — | clang-format dry-run; fails if any file needs reformatting |
+| `analyze-iwyu` | `iwyu` | include-what-you-use; fails on missing or unused `#include` directives |
 | `integration-linux-openssl` | `debug` | Runs the in-process TLS integration tests against libssl (no network oracle) |
 | `bdd-linux-syslog-ng` | — | End-to-end BDD test via Docker Compose (syslog-ng + Behave), Linux runner |
 | `bdd-windows-otel` | — | Windows-eligible BDD scenarios driven against an OTel Collector oracle |
diff --git a/docs/containers.md b/docs/containers.md
index dd312fd2..ac53554a 100644
--- a/docs/containers.md
+++ b/docs/containers.md
@@ -5,7 +5,7 @@
 | Image | Tag | Used by |
 |---|---|---|
 | `ghcr.io/davidcozens/cpputest` | `sha-18f19e1` | devcontainer (`gcc` service), all CI jobs except clang |
-| `ghcr.io/davidcozens/cpputest-clang` | `sha-0385cea` | `clang` compose service, `build-linux-clang` CI job |
+| `ghcr.io/davidcozens/cpputest-clang` | `sha-7eac3ab` | `clang` compose service, `build-linux-clang` CI job, `analyze-iwyu` CI job |
 | `balabit/syslog-ng` | `latest` | `syslog-ng` service — BDD test oracle |
 | `ghcr.io/davidcozens/behave` | `sha-3faff14` | `behave` service — Debian trixie + Python 3.12 + Behave for BDD scenarios |