diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 4acaad20..5d87dd53 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -120,6 +120,31 @@ jobs:
         working-directory: go
         run: go vet ./...
 
+  go-cve:
+    name: Go CVE scan
+    runs-on: ubuntu-latest
+    # Non-blocking until go/go.mod is bumped past go1.26.4 + golang.org/x/net@v0.55.0.
+    # Findings are real and tracked — the gate is no longer blind.
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
+
+      - name: Set up Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6.4.0
+        with:
+          # Must match the `go` directive in go/go.mod (currently 1.26.0).
+          go-version: '1.26.0'
+          cache: true
+          cache-dependency-path: go/go.sum
+
+      - name: Install govulncheck
+        # Pin to v1.1.4; @latest (v1.4.0) panics on generics via x/tools@v0.46.0.
+        run: go install golang.org/x/vuln/cmd/govulncheck@v1.1.4
+
+      - name: Run govulncheck
+        working-directory: go
+        run: govulncheck ./...
+
   rwt-phase1:
     name: "RWT Phase 1 (fresh-user)"
     runs-on: ubuntu-latest