diff --git a/.github/workflows/generate-and-scan-sbom.yml b/.github/workflows/generate-and-scan-sbom.yml
index 0ea6fc6..8278caf 100644
--- a/.github/workflows/generate-and-scan-sbom.yml
+++ b/.github/workflows/generate-and-scan-sbom.yml
@@ -16,7 +16,6 @@ jobs:
     with:
       artifact-name: signed-source-sbom
       component-type: library
-      fail-on-vulnerabilities: true
       file-prefix: sbom-validator-${{ github.run_id }}
       go-version-file: go.mod
       secure-sbom-signing-key-id: ${{ vars.SECURE_SBOM_SIGNING_KEY_ID }}
@@ -24,8 +23,19 @@ jobs:
     secrets:
       secure-sbom-api-key: ${{ secrets.SECURE_SBOM_API_KEY }}
 
-  publish-interlynk:
+  osv-scan:
     needs: source-sbom
+    uses: shiftleftcyber/supply-chain-workflows/.github/workflows/scan-sbom-osv.yml@v1
+    with:
+      artifact-name: ${{ needs.source-sbom.outputs.artifact-name }}
+      fail-on-vulnerabilities: true
+      report-artifact-name: source-osv-scan-report
+      sbom-file: ${{ needs.source-sbom.outputs.signed-sbom-file }}
+
+  publish-interlynk:
+    needs:
+      - source-sbom
+      - osv-scan
     uses: shiftleftcyber/supply-chain-workflows/.github/workflows/publish-sbom-interlynk.yml@v1
     with:
       artifact-name: ${{ needs.source-sbom.outputs.artifact-name }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1afa9d6..58f5b0f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,6 @@ jobs:
     with:
       artifact-name: signed-release-sbom
       component-type: library
-      fail-on-vulnerabilities: true
       file-prefix: sbom-validator-${{ github.ref_name }}
       go-version-file: go.mod
       secure-sbom-signing-key-id: ${{ vars.SECURE_SBOM_SIGNING_KEY_ID }}
@@ -25,8 +24,19 @@ jobs:
     secrets:
       secure-sbom-api-key: ${{ secrets.SECURE_SBOM_API_KEY }}
 
-  release:
+  osv-scan:
     needs: source-sbom
+    uses: shiftleftcyber/supply-chain-workflows/.github/workflows/scan-sbom-osv.yml@v1
+    with:
+      artifact-name: ${{ needs.source-sbom.outputs.artifact-name }}
+      fail-on-vulnerabilities: true
+      report-artifact-name: release-osv-scan-report
+      sbom-file: ${{ needs.source-sbom.outputs.signed-sbom-file }}
+
+  release:
+    needs:
+      - source-sbom
+      - osv-scan
     uses: shiftleftcyber/supply-chain-workflows/.github/workflows/release-go.yml@v1
     with:
       config: .goreleaser.yml
@@ -37,7 +47,9 @@ jobs:
       working-directory: .
 
   publish-interlynk:
-    needs: source-sbom
+    needs:
+      - source-sbom
+      - osv-scan
     uses: shiftleftcyber/supply-chain-workflows/.github/workflows/publish-sbom-interlynk.yml@v1
     with:
       artifact-name: ${{ needs.source-sbom.outputs.artifact-name }}