diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 1c66cfd..e3c2d45 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -59,7 +59,10 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Scan image for vulnerabilities
-        uses: aquasecurity/trivy-action@0.29.0
+        # Pinned to a commit SHA, not a tag: the action's tags carry a leading
+        # "v" (v0.36.0), so the previous "@0.29.0" resolved to nothing and the
+        # job failed at action setup — before the image was ever built.
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}
           format: sarif