diff --git a/.github/workflows/vulnerability-triage.yml b/.github/workflows/vulnerability-triage.yml
index 433fa62b4..677cec059 100644
--- a/.github/workflows/vulnerability-triage.yml
+++ b/.github/workflows/vulnerability-triage.yml
@@ -15,4 +15,10 @@ permissions:
 jobs:
   triage:
     uses: sourcebot-dev/sourcebot/.github/workflows/vulnerability-triage.yml@main
+    with:
+      # Zoekt ships inside the Sourcebot image. Scan its binaries there so Go
+      # module CVEs land on this repository (sourcebot-dev/sourcebot-private
+      # excludes the same targets from its own scan).
+      image: ghcr.io/sourcebot-dev/sourcebot
+      trivy_include_targets: '^usr/local/bin/zoekt-'
     secrets: inherit
diff --git a/trivy.yaml b/trivy.yaml
new file mode 100644
index 000000000..9e1b7a8f4
--- /dev/null
+++ b/trivy.yaml
@@ -0,0 +1,17 @@
+# Docs: https://aquasecurity.github.io/trivy/latest/docs/references/configuration/config-file/
+ 
+scan:
+  scanners:
+    - vuln
+ 
+  pkg-types:
+    - os
+    - library
+ 
+severity:
+  - CRITICAL
+  - HIGH
+  - MEDIUM
+ 
+vulnerability:
+  ignore-unfixed: true
\ No newline at end of file