diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 569587fe..7381d000 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -164,6 +164,7 @@ jobs:
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
           format: 'table'
+          trivy-version: 'latest'
           trivy-config: trivy.yaml
 
       # Mirror of the release-time pre-publish smoke gate in docker-publish.yml.
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index fc950090..4eb7c561 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -112,6 +112,7 @@ jobs:
           exit-code: '1'
           severity: 'CRITICAL,HIGH'
           format: 'table'
+          trivy-version: 'latest'
           trivy-config: trivy.yaml
 
       # Start the scanned image headless on the runner and poll /api/health