diff --git a/plugins/scan.installer b/plugins/scan.installer
new file mode 100644
index 0000000000..3660065f4d
--- /dev/null
+++ b/plugins/scan.installer
@@ -0,0 +1,42 @@
+#!/usr/bin/env bash
+
+set -e
+
+source "$(dirname "$0")/.common"
+PKG=github.com/docker/scan-cli-plugin
+GOPATH=$(go env GOPATH)
+REPO=https://${PKG}.git
+COMMIT=v0.7.0
+DEST=${GOPATH}/src/${PKG}
+
+build() {
+    if [ ! -d "${DEST}" ]; then
+        git clone "${REPO}" "${DEST}"
+    fi
+    (
+        cd "${DEST}"
+        git fetch --all
+        git checkout -q "${COMMIT}"
+        # TODO remove GOPROXY override once we updated to Go 1.14+
+        # Using goproxy instead of "direct" to work around an issue in go mod
+        # on Go 1.13 not working with older git versions (default version on
+        # CentOS 7 is git 1.8), see https://github.com/golang/go/issues/38373
+        GOPROXY="https://proxy.golang.org" PLATFORM_BINARY=docker-scan make native-build
+    )
+}
+
+install_plugin() {
+    (
+        cd "${DEST}"
+        install_binary bin/docker-scan
+    )
+}
+
+case "$(uname -i)" in
+  aarch64)
+    echo "Skipping scan plugin on ARM arch";;
+  arm*)
+    echo "Skipping scan plugin on ARM arch";;
+  *)
+    build_or_install "$@";;
+esac