diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
new file mode 100644
index 0000000..088f993
--- /dev/null
+++ b/.github/workflows/security.yml
@@ -0,0 +1,19 @@
+name: Container Security Scan
+on: [push, pull_request]
+
+jobs:
+  scan:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Build hardened image
+        run: docker build -f dockerfiles/Dockerfile.v4-distroless -t myapp:ci .
+
+      - name: Scan with Trivy (fail on CRITICAL/HIGH)
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: myapp:ci
+          severity: CRITICAL,HIGH
+          exit-code: '1'
+          ignore-unfixed: true
diff --git a/.trivyignore b/.trivyignore
new file mode 100644
index 0000000..de9e7eb
--- /dev/null
+++ b/.trivyignore
@@ -0,0 +1,6 @@
+# Base-image CVEs in gcr.io/distroless/python3-debian12.
+# Fixed in Debian upstream but not yet shipped in the distroless base build.
+# Action: re-pin the base digest and delete these lines once distroless rebuilds.
+# Reviewed 2026-06-23.
+CVE-2025-13836
+CVE-2026-45447