diff --git a/makefiles/scan-build.inc.mk b/makefiles/scan-build.inc.mk
index f91c691b77b5..5160971c7e3c 100644
--- a/makefiles/scan-build.inc.mk
+++ b/makefiles/scan-build.inc.mk
@@ -27,20 +27,25 @@ SCANBUILD_ENV_VARS := \
   QUIET \
   WERROR \
   RIOT_VERSION \
+  RIOT_CI_BUILD \
   SIZE \
   TOOLCHAIN \
   UNDEF \
   USER \
   #
 
+# Produce errors by default at the end of compilation when warning are found
+SCANBUILD_ERROR ?= $(if $(filter 1,$(WERROR)),--status-bugs)
+
 SCANBUILD_ARGS ?= \
   -analyze-headers \
   --use-cc=$(CC) \
   --use-c++=$(CXX) \
   -analyzer-config stable-report-filename=true \
+  $(SCANBUILD_ERROR) \
   #
 
-export SCANBUILD_OUTPUTDIR = $(CURDIR)/scan-build/
+SCANBUILD_OUTPUTDIR = scan-build/$(BOARD)
 
 # Find all variables given on the command line and recreate the command.
 CMDVARS := $(strip $(foreach varname, $(SCANBUILD_ENV_VARS), \
@@ -52,13 +57,29 @@ ENVVARS := $(strip $(foreach varname, $(SCANBUILD_ENV_VARS), \
   '$(varname)=$(subst ','\'',$($(varname)))', \
   )))
 
-.PHONY: scan-build scan-build-analyze scan-build-view
-scan-build: scan-build-view scan-build-analyze
-scan-build-view: scan-build-analyze
+.PHONY: scan-build scan-build-analyze
+.PHONY: ..scan-build-view ..scan-build-analyze
+
+ifeq (1,$(INSIDE_DOCKER))
+# In the container just do the analysis, 'view' will be done by the host
+scan-build: ..scan-build-analyze
+else # INSIDE_DOCKER
+scan-build: ..scan-build-view
+endif # INSIDE_DOCKER
+
+# Prevent 'analyze' from producing an error when doing 'scan-build' and
+# still show the webpage for interractive checking.
+scan-build: SCANBUILD_ERROR=
+
 ifeq ($(BUILD_IN_DOCKER),1)
+# It will trigger executing 'scan-build' or 'scan-build-analyze' with docker
 scan-build-analyze: ..in-docker-container
 else # BUILD_IN_DOCKER
-scan-build-analyze: clean
+scan-build-analyze: ..scan-build-analyze
+endif # BUILD_IN_DOCKER
+
+
+..scan-build-analyze: clean
 	@$(COLOR_ECHO) '$(COLOR_GREEN)Performing Clang static code analysis using toolchain "$(TOOLCHAIN)".$(COLOR_RESET)'
 # ccc-analyzer needs to be told the proper -target setting for best results,
 # otherwise false error reports about unknown register names etc will be produced.
@@ -70,13 +91,9 @@ scan-build-analyze: clean
 	$(Q)mkdir -p '$(SCANBUILD_OUTPUTDIR)'
 	$(Q)env -i $(ENVVARS) \
 	    scan-build -o '$(SCANBUILD_OUTPUTDIR)' $(SCANBUILD_ARGS) \
-	      make -C $(CURDIR) all $(strip $(CMDVARS)) FORCE_ASSERTS=1;
-endif # BUILD_IN_DOCKER
+	      make -C $(CURDIR) all $(strip $(CMDVARS)) FORCE_ASSERTS=1
 
-ifeq (1,$(INSIDE_DOCKER))
-scan-build-view:
-	@
-else
+..scan-build-view: scan-build-analyze
 	@echo "Showing most recent report in your web browser..."
 	@REPORT_FILE="$$(find '$(SCANBUILD_OUTPUTDIR)' -maxdepth 2 -mindepth 2 \
 	            -type f -name 'index.html' 2>/dev/null | sort | tail -n 1)"; \
@@ -86,4 +103,3 @@ else
 	  else \
 	    echo "No report found"; \
 	  fi
-endif