diff --git a/backend/src/__tests__/database-security-overview-helpers.test.ts b/backend/src/__tests__/database-security-overview-helpers.test.ts
index 7f967a0b..3792fb01 100644
--- a/backend/src/__tests__/database-security-overview-helpers.test.ts
+++ b/backend/src/__tests__/database-security-overview-helpers.test.ts
@@ -154,6 +154,136 @@ describe('countEligibleBlockPolicies (replica)', () => {
   });
 });
 
+describe('getImageScanSummaries', () => {
+  function seedScan(o: { imageRef: string; scannersUsed: string; scannedAt: number; critical?: number; high?: number; secret?: number; misconfig?: number }): number {
+    return db().createVulnerabilityScan({
+      node_id: 1,
+      image_ref: o.imageRef,
+      image_digest: `sha256:${o.imageRef}-${Math.random().toString(16).slice(2)}`,
+      scanned_at: o.scannedAt,
+      total_vulnerabilities: (o.critical ?? 0) + (o.high ?? 0),
+      critical_count: o.critical ?? 0,
+      high_count: o.high ?? 0,
+      medium_count: 0,
+      low_count: 0,
+      unknown_count: 0,
+      fixable_count: 0,
+      secret_count: o.secret ?? 0,
+      misconfig_count: o.misconfig ?? 0,
+      scanners_used: o.scannersUsed,
+      highest_severity: (o.critical ?? 0) > 0 ? 'CRITICAL' : (o.high ?? 0) > 0 ? 'HIGH' : null,
+      os_info: null,
+      trivy_version: null,
+      scan_duration_ms: null,
+      triggered_by: 'manual',
+      status: 'completed',
+      error: null,
+      stack_context: o.imageRef.startsWith('stack:') ? o.imageRef.slice(6) : null,
+    });
+  }
+
+  it('sources vuln counts and scan_id from the latest vuln scan, keeping a newer secret-only scan\'s secrets', () => {
+    const vulnScan = seedScan({ imageRef: 'app:1', scannersUsed: 'vuln', scannedAt: 1000, critical: 2, high: 1 });
+    // A newer secret-only node scan must not erase the vulnerability posture, and
+    // the badge's scan_id must open the scan its counts came from (the vuln scan).
+    seedScan({ imageRef: 'app:1', scannersUsed: 'secret', scannedAt: 2000, secret: 5 });
+
+    const summary = db().getImageScanSummaries(1)['app:1'];
+    expect(summary.critical).toBe(2);
+    expect(summary.high).toBe(1);
+    expect(summary.secret_count).toBe(5);
+    expect(summary.scan_id).toBe(vulnScan);
+  });
+
+  it('keeps a compose/config scan row with its misconfig count and zero vuln counts', () => {
+    const configScan = seedScan({ imageRef: 'stack:web', scannersUsed: 'config', scannedAt: 1000, misconfig: 3 });
+    const summary = db().getImageScanSummaries(1)['stack:web'];
+    expect(summary.critical).toBe(0);
+    expect(summary.misconfig_count).toBe(3);
+    expect(summary.scan_id).toBe(configScan);
+  });
+
+  it('treats a combined vuln,secret scan as vulnerability-bearing', () => {
+    const scan = seedScan({ imageRef: 'both:1', scannersUsed: 'vuln,secret', scannedAt: 1000, critical: 1, secret: 2 });
+    const summary = db().getImageScanSummaries(1)['both:1'];
+    expect(summary.critical).toBe(1);
+    expect(summary.secret_count).toBe(2);
+    expect(summary.scan_id).toBe(scan);
+  });
+
+  it('reports zero vuln counts but keeps secrets for an image only ever scanned for secrets', () => {
+    const secretScan = seedScan({ imageRef: 'sec:1', scannersUsed: 'secret', scannedAt: 1000, secret: 4 });
+    const summary = db().getImageScanSummaries(1)['sec:1'];
+    expect(summary.critical).toBe(0);
+    expect(summary.high).toBe(0);
+    expect(summary.secret_count).toBe(4);
+    // No vuln-bearing scan exists, so scan_id falls back to the latest scan overall.
+    expect(summary.scan_id).toBe(secretScan);
+  });
+});
+
+describe('getLatestKevFindingsForNode', () => {
+  function rawDb() {
+    return (db() as unknown as { db: { prepare: (s: string) => { run: () => void } } }).db;
+  }
+  beforeEach(() => {
+    rawDb().prepare('DELETE FROM vulnerability_details').run();
+    rawDb().prepare('DELETE FROM cve_intel').run();
+    rawDb().prepare('DELETE FROM vulnerability_scans').run();
+  });
+
+  function seedVulnScan(o: { imageRef: string; scannersUsed: string; scannedAt: number; nodeId?: number }): number {
+    return db().createVulnerabilityScan({
+      node_id: o.nodeId ?? 1, image_ref: o.imageRef, image_digest: `sha256:${o.imageRef}-${Math.random().toString(16).slice(2)}`,
+      scanned_at: o.scannedAt, total_vulnerabilities: 0, critical_count: 0, high_count: 0, medium_count: 0,
+      low_count: 0, unknown_count: 0, fixable_count: 0, secret_count: 0, misconfig_count: 0,
+      scanners_used: o.scannersUsed, highest_severity: null, os_info: null, trivy_version: null,
+      scan_duration_ms: null, triggered_by: 'manual', status: 'completed', error: null, stack_context: null,
+    });
+  }
+  const detail = (id: string, severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW') => ({
+    vulnerability_id: id, pkg_name: `p-${id}`, installed_version: '1', fixed_version: null,
+    severity, title: null, description: null, primary_url: null,
+  });
+
+  it('returns KEV findings at any severity from the latest vuln scan, restricted to vuln-bearing scanners', () => {
+    const now = Date.now();
+    const vulnScan = seedVulnScan({ imageRef: 'app:1', scannersUsed: 'vuln', scannedAt: now - 1000 });
+    db().insertVulnerabilityDetails(vulnScan, [detail('CVE-LOW-KEV', 'LOW'), detail('CVE-CRIT-PLAIN', 'CRITICAL')]);
+    // A newer secret-only scan also carries a KEV detail; it must be ignored.
+    const secretScan = seedVulnScan({ imageRef: 'app:1', scannersUsed: 'secret', scannedAt: now });
+    db().insertVulnerabilityDetails(secretScan, [detail('CVE-SECRET-KEV', 'HIGH')]);
+    db().replaceKev([
+      { cve_id: 'CVE-LOW-KEV', date_added: '2024-01-01' },
+      { cve_id: 'CVE-SECRET-KEV', date_added: '2024-01-01' },
+    ], now);
+
+    const ids = db().getLatestKevFindingsForNode(1).items.map((i) => i.vulnerability_id);
+    expect(ids).toContain('CVE-LOW-KEV');     // any-severity KEV from the vuln scan
+    expect(ids).not.toContain('CVE-CRIT-PLAIN'); // Critical but not KEV
+    expect(ids).not.toContain('CVE-SECRET-KEV'); // KEV but on a secret-only scan
+  });
+
+  it('flags truncated when the row cap is hit', () => {
+    const now = Date.now();
+    const scan = seedVulnScan({ imageRef: 'many:1', scannersUsed: 'vuln', scannedAt: now });
+    db().insertVulnerabilityDetails(scan, [detail('CVE-K1', 'HIGH'), detail('CVE-K2', 'HIGH'), detail('CVE-K3', 'HIGH')]);
+    db().replaceKev([{ cve_id: 'CVE-K1', date_added: null }, { cve_id: 'CVE-K2', date_added: null }, { cve_id: 'CVE-K3', date_added: null }], now);
+    const res = db().getLatestKevFindingsForNode(1, 2);
+    expect(res.truncated).toBe(true);
+    expect(res.items).toHaveLength(2);
+  });
+
+  it('is node-scoped', () => {
+    const now = Date.now();
+    const scan = seedVulnScan({ imageRef: 'other:1', scannersUsed: 'vuln', scannedAt: now, nodeId: 2 });
+    db().insertVulnerabilityDetails(scan, [detail('CVE-OTHER', 'CRITICAL')]);
+    db().replaceKev([{ cve_id: 'CVE-OTHER', date_added: null }], now);
+    expect(db().getLatestKevFindingsForNode(1).items).toHaveLength(0);
+    expect(db().getLatestKevFindingsForNode(2).items).toHaveLength(1);
+  });
+});
+
 describe('getDailyRiskTrend', () => {
   it('sums latest-per-image critical/high per day and orders days ascending', () => {
     const day1 = dayStartMs(3);
diff --git a/backend/src/__tests__/security-overview-route.test.ts b/backend/src/__tests__/security-overview-route.test.ts
index 872cb7b3..8d281f90 100644
--- a/backend/src/__tests__/security-overview-route.test.ts
+++ b/backend/src/__tests__/security-overview-route.test.ts
@@ -239,6 +239,85 @@ describe('GET /api/security/overview', () => {
     expect(res.body).toMatchObject({ knownExploited: 1, fixableCriticalHigh: 0, posture: 'Action needed' });
   });
 
+  it('preserves vulnerability posture when a newer secret-only scan exists for the same image', async () => {
+    const now = Date.now();
+    // Vulnerability scan: one unfixable Critical that is known-exploited.
+    const vulnScan = db().createVulnerabilityScan({
+      node_id: 1, image_ref: 'app:1', image_digest: 'sha256:app-vuln', scanned_at: now - 1000,
+      total_vulnerabilities: 1, critical_count: 1, high_count: 0, medium_count: 0, low_count: 0,
+      unknown_count: 0, fixable_count: 0, secret_count: 0, misconfig_count: 0, scanners_used: 'vuln',
+      highest_severity: 'CRITICAL', os_info: null, trivy_version: null, scan_duration_ms: null,
+      triggered_by: 'manual', status: 'completed', error: null, stack_context: null,
+    });
+    db().insertVulnerabilityDetails(vulnScan, [{
+      vulnerability_id: 'CVE-2024-5001', pkg_name: 'libkev', installed_version: '1', fixed_version: null,
+      severity: 'CRITICAL', title: null, description: null, primary_url: null,
+    }]);
+    db().replaceKev([{ cve_id: 'CVE-2024-5001', date_added: '2024-01-01' }], now);
+    // Newer secret-only node scan for the SAME image: no vuln details, carries a secret.
+    db().createVulnerabilityScan({
+      node_id: 1, image_ref: 'app:1', image_digest: 'sha256:app-secret', scanned_at: now,
+      total_vulnerabilities: 0, critical_count: 0, high_count: 0, medium_count: 0, low_count: 0,
+      unknown_count: 0, fixable_count: 0, secret_count: 1, misconfig_count: 0, scanners_used: 'secret',
+      highest_severity: null, os_info: null, trivy_version: null, scan_duration_ms: null,
+      triggered_by: 'manual', status: 'completed', error: null, stack_context: null,
+    });
+
+    const res = await request(app).get('/api/security/overview').set('Cookie', adminCookie);
+    expect(res.status).toBe(200);
+    // The secret-only scan must not erase the vulnerability posture, and its
+    // secret finding is still counted.
+    expect(res.body).toMatchObject({
+      critical: 1,
+      knownExploited: 1,
+      secrets: 1,
+      posture: 'Action needed',
+    });
+  });
+
+  it('counts a Low/Medium known-exploited finding in knownExploited and posture (matches the deploy gate)', async () => {
+    const now = Date.now();
+    const scanId = db().createVulnerabilityScan({
+      node_id: 1, image_ref: 'lowkev:1', image_digest: 'sha256:lowkev', scanned_at: now,
+      total_vulnerabilities: 1, critical_count: 0, high_count: 0, medium_count: 0, low_count: 1,
+      unknown_count: 0, fixable_count: 0, secret_count: 0, misconfig_count: 0, scanners_used: 'vuln',
+      highest_severity: 'LOW', os_info: null, trivy_version: null, scan_duration_ms: null,
+      triggered_by: 'manual', status: 'completed', error: null, stack_context: null,
+    });
+    db().insertVulnerabilityDetails(scanId, [{
+      vulnerability_id: 'CVE-2024-5002', pkg_name: 'liblow', installed_version: '1', fixed_version: null,
+      severity: 'LOW', title: null, description: null, primary_url: null,
+    }]);
+    // The deploy gate blocks a KEV at any severity; the overview must agree.
+    db().replaceKev([{ cve_id: 'CVE-2024-5002', date_added: '2024-01-01' }], now);
+
+    const res = await request(app).get('/api/security/overview').set('Cookie', adminCookie);
+    expect(res.status).toBe(200);
+    expect(res.body).toMatchObject({ knownExploited: 1, posture: 'Action needed' });
+  });
+
+  it('excludes a suppressed (accepted) KEV from knownExploited', async () => {
+    const now = Date.now();
+    const scanId = db().createVulnerabilityScan({
+      node_id: 1, image_ref: 'suppkev:1', image_digest: 'sha256:suppkev', scanned_at: now,
+      total_vulnerabilities: 2, critical_count: 0, high_count: 0, medium_count: 2, low_count: 0,
+      unknown_count: 0, fixable_count: 0, secret_count: 0, misconfig_count: 0, scanners_used: 'vuln',
+      highest_severity: 'MEDIUM', os_info: null, trivy_version: null, scan_duration_ms: null,
+      triggered_by: 'manual', status: 'completed', error: null, stack_context: null,
+    });
+    db().insertVulnerabilityDetails(scanId, [
+      { vulnerability_id: 'CVE-2024-KEVA', pkg_name: 'a', installed_version: '1', fixed_version: null, severity: 'MEDIUM', title: null, description: null, primary_url: null },
+      { vulnerability_id: 'CVE-2024-KEVB', pkg_name: 'b', installed_version: '1', fixed_version: null, severity: 'MEDIUM', title: null, description: null, primary_url: null },
+    ]);
+    db().replaceKev([{ cve_id: 'CVE-2024-KEVA', date_added: '2024-01-01' }, { cve_id: 'CVE-2024-KEVB', date_added: '2024-01-01' }], now);
+    // KEVA is accepted (dismissed); only the live KEVB remains actionable.
+    db().createCveSuppression({ cve_id: 'CVE-2024-KEVA', pkg_name: null, image_pattern: null, reason: 'accepted', created_by: 'admin', created_at: now, expires_at: null, replicated_from_control: 0, status: 'accepted' });
+
+    const res = await request(app).get('/api/security/overview').set('Cookie', adminCookie);
+    expect(res.status).toBe(200);
+    expect(res.body.knownExploited).toBe(1);
+  });
+
   it('reads Secure when a scan completed with nothing actionable or severe', async () => {
     db().createVulnerabilityScan({
       node_id: 1, image_ref: 'clean:1', image_digest: 'sha256:clean', scanned_at: Date.now(),
@@ -436,6 +515,29 @@ describe('GET /api/security/overview/exploit-intel', () => {
     expect(res.body.truncated).toBe(false);
   });
 
+  it('includes a Medium/Low known-exploited finding alongside Critical/High', async () => {
+    const now = Date.now();
+    const scanId = db().createVulnerabilityScan({
+      node_id: 1, image_ref: 'mix:1', image_digest: 'sha256:mix', scanned_at: now,
+      total_vulnerabilities: 2, critical_count: 0, high_count: 0, medium_count: 1, low_count: 1,
+      unknown_count: 0, fixable_count: 0, secret_count: 0, misconfig_count: 0, scanners_used: 'vuln',
+      highest_severity: 'MEDIUM', os_info: null, trivy_version: null, scan_duration_ms: null,
+      triggered_by: 'manual', status: 'completed', error: null, stack_context: null,
+    });
+    db().insertVulnerabilityDetails(scanId, [
+      { vulnerability_id: 'CVE-2024-MEDK', pkg_name: 'm', installed_version: '1', fixed_version: null, severity: 'MEDIUM', title: null, description: null, primary_url: null, cvss_score: 5.5 },
+      { vulnerability_id: 'CVE-2024-LOWN', pkg_name: 'l', installed_version: '1', fixed_version: null, severity: 'LOW', title: null, description: null, primary_url: null, cvss_score: 3.1 },
+    ]);
+    // Only the Medium finding is known-exploited; the Low non-KEV stays out.
+    db().replaceKev([{ cve_id: 'CVE-2024-MEDK', date_added: '2024-01-01' }], now);
+
+    const res = await request(app).get('/api/security/overview/exploit-intel').set('Cookie', adminCookie);
+    expect(res.status).toBe(200);
+    const ids = (res.body.items as Array<{ vulnerability_id: string }>).map((i) => i.vulnerability_id);
+    expect(ids).toContain('CVE-2024-MEDK');
+    expect(ids).not.toContain('CVE-2024-LOWN');
+  });
+
   it('requires authentication', async () => {
     const res = await request(app).get('/api/security/overview/exploit-intel');
     expect(res.status).toBe(401);
diff --git a/backend/src/routes/security.ts b/backend/src/routes/security.ts
index 6b05aae8..dd51ee17 100644
--- a/backend/src/routes/security.ts
+++ b/backend/src/routes/security.ts
@@ -736,7 +736,6 @@ securityRouter.get('/overview', authMiddleware, (req: Request, res: Response): v
     let accepted = 0;
     let notAffected = 0;
     let needsReview = 0;
-    let knownExploited = 0;
     for (const [imageRef, group] of critHighByImage) {
       for (const e of applySuppressions(group, imageRef, cveSuppressions)) {
         if (e.triage_status === 'needs_review') needsReview += 1;
@@ -748,7 +747,24 @@ securityRouter.get('/overview', authMiddleware, (req: Request, res: Response): v
         }
         // Not dismissed (no decision, needs_review, or affected): still actionable.
         if (e.fixed_version) fixableCriticalHigh += 1;
-        if (intel.get(e.vulnerability_id)?.kev) knownExploited += 1;
+      }
+    }
+
+    // A known-exploited (KEV) finding gates a deploy at ANY severity, so the
+    // posture fact counts non-suppressed KEV findings across all severities, not
+    // just Critical/High. Sourced from its own latest-scan query so a Low/Medium
+    // KEV that the gate would block on is never invisible on the overview.
+    const kevFindings = db.getLatestKevFindingsForNode(req.nodeId);
+    const kevByImage = new Map<string, typeof kevFindings.items>();
+    for (const f of kevFindings.items) {
+      const group = kevByImage.get(f.image_ref);
+      if (group) group.push(f);
+      else kevByImage.set(f.image_ref, [f]);
+    }
+    let knownExploited = 0;
+    for (const [imageRef, group] of kevByImage) {
+      for (const e of applySuppressions(group, imageRef, cveSuppressions)) {
+        if (!e.suppressed) knownExploited += 1;
       }
     }
 
@@ -858,7 +874,7 @@ securityRouter.get('/overview', authMiddleware, (req: Request, res: Response): v
       notAffected,
       actionable,
       posture,
-      posturePartial: critHigh.truncated || highMisconfigs.truncated,
+      posturePartial: critHigh.truncated || kevFindings.truncated || highMisconfigs.truncated,
       postureReasons,
       primaryAction,
     };
@@ -899,10 +915,10 @@ interface ExploitIntelFinding {
 }
 
 // Node-scoped, auth-only (Community). Returns the latest-scan Critical/High
-// findings that are still actionable (dismissed triage decisions filtered out),
-// enriched at read time with KEV/EPSS intel. Powers the Top exploit-risk list
-// and the CVSS-by-EPSS quadrant on the Security overview. Bounded; `truncated`
-// flags a capped node.
+// findings (plus known-exploited findings at any severity) that are still
+// actionable (dismissed triage decisions filtered out), enriched at read time
+// with KEV/EPSS intel. Powers the Top exploit-risk list and the CVSS-by-EPSS
+// quadrant on the Security overview. Bounded; `truncated` flags a capped node.
 securityRouter.get('/overview/exploit-intel', authMiddleware, (req: Request, res: Response): void => {
   try {
     const db = DatabaseService.getInstance();
diff --git a/backend/src/services/DatabaseService.ts b/backend/src/services/DatabaseService.ts
index f86db5f0..e2a3c5a1 100644
--- a/backend/src/services/DatabaseService.ts
+++ b/backend/src/services/DatabaseService.ts
@@ -4963,21 +4963,47 @@ export class DatabaseService {
     }
 
     public getImageScanSummaries(nodeId: number): Record<string, ScanSummary> {
+        // The per-image row is the latest scan overall (so a secret-only or
+        // compose/config scan still contributes its secret/misconfig counts and
+        // staleness), but the vulnerability counts are sourced from the latest
+        // VULN-bearing scan via a LEFT JOIN. Without this, a newer secret-only
+        // node scan would clobber an image's Critical/High posture to zero.
+        const placeholders = VULN_BEARING_SCANNER_SETS.map(() => '?').join(', ');
         const rows = this.db
             .prepare(
-                `SELECT vs.image_ref, vs.id as scan_id, vs.highest_severity, vs.total_vulnerabilities,
-                    vs.critical_count, vs.high_count, vs.medium_count, vs.low_count,
-                    vs.unknown_count, vs.fixable_count, vs.secret_count, vs.misconfig_count, vs.scanned_at
-                 FROM vulnerability_scans vs
+                `SELECT base.image_ref, base.scanned_at,
+                    base.secret_count, base.misconfig_count,
+                    COALESCE(vuln.scan_id, base.id) AS scan_id,
+                    COALESCE(vuln.highest_severity, base.highest_severity) AS highest_severity,
+                    COALESCE(vuln.total_vulnerabilities, 0) AS total_vulnerabilities,
+                    COALESCE(vuln.critical_count, 0) AS critical_count,
+                    COALESCE(vuln.high_count, 0) AS high_count,
+                    COALESCE(vuln.medium_count, 0) AS medium_count,
+                    COALESCE(vuln.low_count, 0) AS low_count,
+                    COALESCE(vuln.unknown_count, 0) AS unknown_count,
+                    COALESCE(vuln.fixable_count, 0) AS fixable_count
+                 FROM vulnerability_scans base
                  INNER JOIN (
                    SELECT image_ref, MAX(scanned_at) AS max_scanned
                    FROM vulnerability_scans
                    WHERE node_id = ? AND status = 'completed'
                    GROUP BY image_ref
-                 ) latest ON latest.image_ref = vs.image_ref AND latest.max_scanned = vs.scanned_at
-                 WHERE vs.node_id = ? AND vs.status = 'completed'`,
+                 ) latest ON latest.image_ref = base.image_ref AND latest.max_scanned = base.scanned_at
+                 LEFT JOIN (
+                   SELECT v.image_ref, v.id AS scan_id, v.highest_severity, v.total_vulnerabilities, v.critical_count,
+                          v.high_count, v.medium_count, v.low_count, v.unknown_count, v.fixable_count
+                   FROM vulnerability_scans v
+                   INNER JOIN (
+                     SELECT image_ref, MAX(scanned_at) AS max_scanned
+                     FROM vulnerability_scans
+                     WHERE node_id = ? AND status = 'completed' AND scanners_used IN (${placeholders})
+                     GROUP BY image_ref
+                   ) lv ON lv.image_ref = v.image_ref AND lv.max_scanned = v.scanned_at
+                   WHERE v.node_id = ? AND v.status = 'completed' AND v.scanners_used IN (${placeholders})
+                 ) vuln ON vuln.image_ref = base.image_ref
+                 WHERE base.node_id = ? AND base.status = 'completed'`,
             )
-            .all(nodeId, nodeId) as Array<{
+            .all(nodeId, nodeId, ...VULN_BEARING_SCANNER_SETS, nodeId, ...VULN_BEARING_SCANNER_SETS, nodeId) as Array<{
                 image_ref: string;
                 scan_id: number;
                 highest_severity: VulnSeverity | null;
@@ -5029,6 +5055,7 @@ export class DatabaseService {
         items: Array<{ image_ref: string; vulnerability_id: string; pkg_name: string; fixed_version: string | null }>;
         truncated: boolean;
     } {
+        const placeholders = VULN_BEARING_SCANNER_SETS.map(() => '?').join(', ');
         const rows = this.db
             .prepare(
                 `SELECT vs.image_ref, vd.vulnerability_id, vd.pkg_name, vd.fixed_version
@@ -5037,14 +5064,55 @@ export class DatabaseService {
                  INNER JOIN (
                    SELECT image_ref, MAX(scanned_at) AS max_scanned
                    FROM vulnerability_scans
-                   WHERE node_id = ? AND status = 'completed'
+                   WHERE node_id = ? AND status = 'completed' AND scanners_used IN (${placeholders})
                    GROUP BY image_ref
                  ) latest ON latest.image_ref = vs.image_ref AND latest.max_scanned = vs.scanned_at
-                 WHERE vs.node_id = ? AND vs.status = 'completed'
+                 WHERE vs.node_id = ? AND vs.status = 'completed' AND vs.scanners_used IN (${placeholders})
                    AND vd.severity IN ('CRITICAL', 'HIGH')
                  LIMIT ?`,
             )
-            .all(nodeId, nodeId, limit + 1) as Array<{
+            .all(nodeId, ...VULN_BEARING_SCANNER_SETS, nodeId, ...VULN_BEARING_SCANNER_SETS, limit + 1) as Array<{
+                image_ref: string;
+                vulnerability_id: string;
+                pkg_name: string;
+                fixed_version: string | null;
+            }>;
+        const truncated = rows.length > limit;
+        return { items: truncated ? rows.slice(0, limit) : rows, truncated };
+    }
+
+    /**
+     * Known-exploited (CISA KEV) findings at ANY severity from the latest
+     * completed vuln-bearing scan per image, for the `knownExploited` posture
+     * fact. The deploy gate blocks a KEV regardless of severity, so this is not
+     * restricted to Critical/High the way the fixable/triage helpers are.
+     * Suppression filtering is applied by the caller at read time. Same bounded
+     * shape as `getLatestCritHighVulnFindingsForNode`.
+     */
+    public getLatestKevFindingsForNode(
+        nodeId: number,
+        limit = 5000,
+    ): {
+        items: Array<{ image_ref: string; vulnerability_id: string; pkg_name: string; fixed_version: string | null }>;
+        truncated: boolean;
+    } {
+        const placeholders = VULN_BEARING_SCANNER_SETS.map(() => '?').join(', ');
+        const rows = this.db
+            .prepare(
+                `SELECT vs.image_ref, vd.vulnerability_id, vd.pkg_name, vd.fixed_version
+                 FROM vulnerability_details vd
+                 INNER JOIN vulnerability_scans vs ON vs.id = vd.scan_id
+                 INNER JOIN cve_intel ci ON ci.cve_id = vd.vulnerability_id AND ci.kev = 1
+                 INNER JOIN (
+                   SELECT image_ref, MAX(scanned_at) AS max_scanned
+                   FROM vulnerability_scans
+                   WHERE node_id = ? AND status = 'completed' AND scanners_used IN (${placeholders})
+                   GROUP BY image_ref
+                 ) latest ON latest.image_ref = vs.image_ref AND latest.max_scanned = vs.scanned_at
+                 WHERE vs.node_id = ? AND vs.status = 'completed' AND vs.scanners_used IN (${placeholders})
+                 LIMIT ?`,
+            )
+            .all(nodeId, ...VULN_BEARING_SCANNER_SETS, nodeId, ...VULN_BEARING_SCANNER_SETS, limit + 1) as Array<{
                 image_ref: string;
                 vulnerability_id: string;
                 pkg_name: string;
@@ -5084,11 +5152,14 @@ export class DatabaseService {
     }
 
     /**
-     * Critical/High findings from the latest completed scan per image, with the
-     * severity + CVSS the overview's exploit-intel charts need. Same bounded
-     * shape as getLatestCritHighVulnFindingsForNode (single latest-per-image
-     * JOIN, capped, `truncated` flagged). Intel (KEV/EPSS) and suppression
-     * filtering are applied by the caller at read time.
+     * Critical/High findings (plus known-exploited findings at any severity)
+     * from the latest completed scan per image, with the severity + CVSS the
+     * overview's exploit-intel charts need. Same bounded shape as
+     * getLatestCritHighVulnFindingsForNode (single latest-per-image JOIN, capped,
+     * `truncated` flagged). A KEV finding gates a deploy regardless of its
+     * severity, so a Medium/Low KEV is selected here (via the cve_intel join) to
+     * match the gate. Intel (KEV/EPSS) and suppression filtering are applied by
+     * the caller at read time.
      */
     public getLatestCritHighFindingsWithCvssForNode(
         nodeId: number,
@@ -5105,23 +5176,25 @@ export class DatabaseService {
         }>;
         truncated: boolean;
     } {
+        const placeholders = VULN_BEARING_SCANNER_SETS.map(() => '?').join(', ');
         const rows = this.db
             .prepare(
                 `SELECT vs.image_ref, vs.id AS scan_id, vd.vulnerability_id, vd.pkg_name,
                         vd.severity, vd.cvss_score, vd.fixed_version
                  FROM vulnerability_details vd
                  INNER JOIN vulnerability_scans vs ON vs.id = vd.scan_id
+                 LEFT JOIN cve_intel ci ON ci.cve_id = vd.vulnerability_id
                  INNER JOIN (
                    SELECT image_ref, MAX(scanned_at) AS max_scanned
                    FROM vulnerability_scans
-                   WHERE node_id = ? AND status = 'completed'
+                   WHERE node_id = ? AND status = 'completed' AND scanners_used IN (${placeholders})
                    GROUP BY image_ref
                  ) latest ON latest.image_ref = vs.image_ref AND latest.max_scanned = vs.scanned_at
-                 WHERE vs.node_id = ? AND vs.status = 'completed'
-                   AND vd.severity IN ('CRITICAL', 'HIGH')
+                 WHERE vs.node_id = ? AND vs.status = 'completed' AND vs.scanners_used IN (${placeholders})
+                   AND (vd.severity IN ('CRITICAL', 'HIGH') OR ci.kev = 1)
                  LIMIT ?`,
             )
-            .all(nodeId, nodeId, limit + 1) as Array<{
+            .all(nodeId, ...VULN_BEARING_SCANNER_SETS, nodeId, ...VULN_BEARING_SCANNER_SETS, limit + 1) as Array<{
                 image_ref: string;
                 scan_id: number;
                 vulnerability_id: string;