diff --git a/.circleci/config.yml b/.circleci/config.yml
index 8063f259c..80dbab808 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -90,3 +90,12 @@ workflows:
             - run:
                 name: Lint
                 command: ./gradlew lintPlayRelease
+      - build:
+          name: SpotBugs
+          build-steps:
+            - run:
+                name: SpotBugs (Modules with Play flavour)
+                command: ./gradlew spotbugsPlayDebug | grep "\[SpotBugs\]"
+            - run:
+                name: SpotBugs (Modules without Play flavour)
+                command: ./gradlew spotbugsDebug | grep "\[SpotBugs\]"
diff --git a/build.gradle b/build.gradle
index e4c95ae30..6e0ccddec 100644
--- a/build.gradle
+++ b/build.gradle
@@ -9,6 +9,7 @@ buildscript {
         classpath 'com.android.tools.build:gradle:3.6.3'
         classpath 'com.getkeepsafe.dexcount:dexcount-gradle-plugin:1.0.2'
         classpath 'de.timfreiheit.resourceplaceholders:placeholders:0.3'
+        classpath "gradle.plugin.com.github.spotbugs.snom:spotbugs-gradle-plugin:4.7.0"
     }
 }
 
@@ -25,6 +26,38 @@ allprojects {
             options.compilerArgs << "-Xlint"
         }
     }
+
+    apply plugin: 'com.github.spotbugs'
+
+    spotbugs {
+        effort = 'max'
+        reportLevel = 'high' // for now
+        excludeFilter = rootProject.file('config/spotbugs/exclude.xml')
+        ignoreFailures = true // Handled by printing task
+    }
+
+    gradle.taskGraph.beforeTask { task ->
+        if (task.name.toLowerCase().contains('spotbugs')) {
+            task.doLast {
+                def reportFile = task.project.file("build/reports/spotbugs/playDebug.xml")
+                if (!reportFile.exists()) return
+                def slurped = new XmlSlurper().parse(reportFile)
+
+                def foundErrors = false
+                slurped['BugInstance'].each { bug ->
+                    logger.error "[SpotBugs] ${bug['LongMessage']} [${bug.@'type'}]"
+                    bug['SourceLine'].each { line ->
+                        logger.error "[SpotBugs]     ${line['Message']}"
+                        foundErrors = true
+                    }
+                }
+                if (foundErrors) {
+                    throw new TaskExecutionException(task,
+                            new Exception("SpotBugs violations were found. See output above for details."))
+                }
+            }
+        }
+    }
 }
 
 // Disable predex if requested (we can"t predex in Circle CI
diff --git a/config/spotbugs/exclude.xml b/config/spotbugs/exclude.xml
new file mode 100644
index 000000000..4c1e23ece
--- /dev/null
+++ b/config/spotbugs/exclude.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<FindBugsFilter>
+    <Match>
+        <Bug pattern="v   WEAK_MESSAGE_DIGEST_MD5"/>
+    </Match>
+    <Match>
+        <Bug pattern="v  LI_LAZY_INIT_UPDATE_STATIC"/>
+    </Match>
+    <Match>
+        <Bug pattern="NM_SAME_SIMPLE_NAME_AS_SUPERCLASS"/>
+        <Class name="de.danoeh.antennapod.menuhandler.MenuItemUtils"/>
+    </Match>
+</FindBugsFilter>