diff --git a/trivy.yaml b/trivy.yaml
new file mode 100644
index 000000000..cb01d9d12
--- /dev/null
+++ b/trivy.yaml
@@ -0,0 +1,4 @@
+# Python sample tests run only locally (uv run pytest); nothing in CI or the published site uses them.
+scan:
+  skip-dirs:
+    - test/python