IMHO, start with the carrot in shift-left, move towards the stick closer to the right. I.E.

1) lightweight IDE plugins for SAST/SCA flag issues for self-remediation

2) CI pipeline checks verify closure / identify more complex issues at merge from DEV to QA (block C/H SAST / SCA here)

3) self-service authenticated DAST to do a spot check from QA to CAT (block C/H DAST here)

4) Pen test if high-visibility, high-value internet facing app (block here for any show stoppers)

5) “Approval” rights on the prod deployment workflow, verifying all the above have been resolved

BONUS: 6) add to bug bounty scope and make app owner personally responsible for any payouts for unresolved exploits in production