Integrate PQC into CI/CD Pipelines
For organizations practicing DevSecOps, PQC migration must be integrated into the development pipeline rather than handled as a separate initiative. This course covers integrating cryptographic migration into CI/CD: scanning for cryptographic dependencies, testing post-quantum implementations in staging, managing certificates and keys for dual-stack deployments, and handling container and Kubernetes considerations.
Course Outline
Module 1. Cryptographic Dependency Scanning in CI/CD
Integrating cryptographic discovery into the development pipeline. Scanning code and dependencies for cryptographic usage. Automated CBOM generation in CI/CD. Failing builds on policy violations. Tracking cryptographic debt as code.
Module 2. Testing PQC in the Pipeline
Post-quantum testing in staging environments. Automated testing for hybrid implementations. Performance regression testing for cryptographic changes. Interoperability testing in CI/CD. Negative testing for downgrade prevention.
Module 3. Key and Certificate Management for Dual-Stack
Managing certificates and keys for dual-algorithm deployments. Secrets management for PQC. Automating certificate provisioning for dual-stack. Key rotation in agile pipelines.
Module 4. Container and Kubernetes Considerations
PQC in containerized environments. Service mesh cryptographic migration. mTLS with post-quantum algorithms in Kubernetes. Image signing with post-quantum signatures. Managing cryptographic configuration across container orchestration.
Prerequisites
A working understanding of PQC fundamentals is recommended. Consider Post-Quantum Foundation or PQCS certification for background. Some courses assume security engineering experience.
Certificate of Completion
Upon completion, you will receive a Quantum Academy certificate of completion. CPE credits earned may apply toward Quantum Academy certification maintenance.
Who this course is for
Platform and DevSecOps engineers, CI/CD owners, and application security teams who will have to make cryptographic change routine rather than exceptional. Familiarity with pipeline tooling is assumed.
If you are planning a migration program rather than building the pipelines that execute it, PQC Migration Project Management is the closer fit.
What you’ll be able to do afterward
- Integrate post-quantum checks into CI/CD so cryptographic change becomes routine rather than exceptional
- Run cryptographic dependency scanning across repositories and build artifacts
- Stand up post-quantum testing in staging that catches breakage before production
- Automate certificate and key rotation paths that still work after an algorithm change
- Treat the pipeline itself as cryptographic estate, including signing and provenance
What you leave with
You leave with the course handbook, a PDF of the full material with the instructor notes written out in place of the slides’ bullet points, and a PDF copy of Quantum Ready, included at no extra cost. The handbook is yours to keep. For most organizations, that shared reference is the clearest return on a training budget.
Enrollment includes 180 days of access to the online on-demand course. Where that course is not yet published, the 180 days start on the day it is.
Where this course fits
Post-Quantum Foundation or PQCS Specialist Training give the grounding this course builds on. Neither is enforced. Cryptographic Agility for the design principles, and Cryptographic Discovery, Inventory, and CBOM for the inventory that pipelines should be enforcing against.
Why we teach this
The course is built on the Applied Quantum PQC Migration Framework, published openly under Creative Commons at pqcframework.org and written by the practitioners who teach here. The people who teach this course are running migration programs inside organizations now, and the course covers what those programs hit.
About this program
Quantum Academy credentials are private professional credentials issued by Quantum Academy, a trade name of Post-Quantum Institute. They are not government-issued licenses, accredited degrees, or academic credit, and earning one does not guarantee employment, promotion, regulatory approval, or any other specific outcome.
Quantum Academy programs are educational and informational only, and are not legal, compliance, or engineering advice.