diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 10c27101b..63e51946f 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -297,6 +297,13 @@ jobs:
           echo "No errors or exceptions detected in openidm logs"
   build-docker:
     runs-on: 'ubuntu-latest'
+    needs: build-maven
+    # the zip comes from the ubuntu-latest-25 leg alone: a red leg elsewhere in the matrix must not skip
+    # the docker test and the scan; a red ubuntu-latest-25 leg fails the artifact download below
+    if: ${{ !cancelled() }}
+    permissions:
+      contents: read
+      security-events: write # upload the Trivy scan results to code scanning
     services:
       registry:
         image: registry:2
@@ -306,11 +313,24 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+      - name: Download OpenIDM zip artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: ubuntu-latest-25
+          path: openidm-zip/target
+      - name: Prepare Dockerfile
+        # build the image from this commit's zip instead of downloading the latest release,
+        # so the docker test and the Trivy scan cover this commit's own dependencies
+        shell: bash
+        run: |
+          sed -i -E '/^#COPY openidm-zip/s/^#//' ./Dockerfile
+          grep -q '^COPY openidm-zip/target/openidm-' ./Dockerfile
       - name: Get latest release version
         shell: bash
         run:   |
           export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenIDM/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
           echo "release_version=$git_version_last" >> $GITHUB_ENV
+          echo "image_repository=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v6
@@ -331,8 +351,7 @@ jobs:
         with:
           context: .
           file: ./Dockerfile
-          build-args: |
-            VERSION=${{ env.release_version }}
+          # no VERSION build-arg: with it the Dockerfile replaces the copied zip with the release
           platforms: linux/amd64, linux/arm64/8, linux/ppc64le, linux/s390x, linux/riscv64 #, linux/arm/v7
           push: true
           tags: ${{ steps.meta.outputs.tags }}
@@ -343,8 +362,44 @@ jobs:
           docker run --rm -it -d --memory="1g" --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
           timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test | grep -q \"healthy\"; do sleep 10; done'
           docker logs test
+          # the image must carry this commit's bundles, not a downloaded release (as with a VERSION build-arg)
+          ver=$(basename openidm-zip/target/openidm-*.zip .zip); ver=${ver#openidm-}
+          # no "ls | grep -q": grep exits on the first match, ls dies of SIGPIPE and pipefail fails the step (141)
+          bundles=$(docker exec test ls /opt/openidm/bundle)
+          grep -q -- "-${ver}.jar" <<< "$bundles"
+      - name: Scan image for vulnerabilities (Trivy)
+        # trivy resolves the image from the local Docker daemon, so only the runner's
+        # linux/amd64 manifest is scanned; cache: false keeps the ~1GB trivy DBs from
+        # evicting the m2-repository caches out of the repo's 10GB actions-cache quota
+        continue-on-error: true # a trivy binary or DB download failure must not fail the docker test job
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: localhost:5000/${{ env.image_repository }}:${{ env.release_version }}
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH
+          limit-severities-for-sarif: true
+          ignore-unfixed: true
+          scanners: vuln
+          cache: false
+      - name: Upload Trivy report to GitHub Security
+        uses: github/codeql-action/upload-sarif@v4
+        continue-on-error: true
+        # upload even if a preceding step failed, but not without a report to upload
+        if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
+        with:
+          sarif_file: trivy-results.sarif
+          # distinct from the docker-scan.yml categories, which track the published images
+          category: trivy-build-default
   build-docker-alpine:
     runs-on: 'ubuntu-latest'
+    needs: build-maven
+    # the zip comes from the ubuntu-latest-25 leg alone: a red leg elsewhere in the matrix must not skip
+    # the docker test and the scan; a red ubuntu-latest-25 leg fails the artifact download below
+    if: ${{ !cancelled() }}
+    permissions:
+      contents: read
+      security-events: write # upload the Trivy scan results to code scanning
     services:
       registry:
         image: registry:2
@@ -354,11 +409,24 @@ jobs:
       - uses: actions/checkout@v6
         with:
           fetch-depth: 0
+      - name: Download OpenIDM zip artifact
+        uses: actions/download-artifact@v8
+        with:
+          name: ubuntu-latest-25
+          path: openidm-zip/target
+      - name: Prepare Dockerfile
+        # build the image from this commit's zip instead of downloading the latest release,
+        # so the docker test and the Trivy scan cover this commit's own dependencies
+        shell: bash
+        run: |
+          sed -i -E '/^#COPY openidm-zip/s/^#//' ./Dockerfile-alpine
+          grep -q '^COPY openidm-zip/target/openidm-' ./Dockerfile-alpine
       - name: Get latest release version
         shell: bash
         run:   |
           export git_version_last="$(curl -i -o - --silent https://api.github.com/repos/OpenIdentityPlatform/OpenIDM/releases/latest | grep -m1 "\"name\"" | cut -d\" -f4)" ; echo "last release: $git_version_last"
           echo "release_version=$git_version_last" >> $GITHUB_ENV
+          echo "image_repository=${GITHUB_REPOSITORY,,}" >> $GITHUB_ENV
       - name: Docker meta
         id: meta
         uses: docker/metadata-action@v6
@@ -380,8 +448,7 @@ jobs:
         with:
           context: .
           file: ./Dockerfile-alpine
-          build-args: |
-            VERSION=${{ env.release_version }}
+          # no VERSION build-arg: with it the Dockerfile replaces the copied zip with the release
           platforms: linux/amd64, linux/arm64/8, linux/s390x, linux/ppc64le, linux/riscv64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
@@ -392,3 +459,32 @@ jobs:
           docker run --rm -it -d --memory="1g" --name=test localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}-alpine
           timeout 3m bash -c 'until docker inspect --format="{{json .State.Health.Status}}" test | grep -q \"healthy\"; do sleep 10; done'
           docker logs test
+          # the image must carry this commit's bundles, not a downloaded release (as with a VERSION build-arg)
+          ver=$(basename openidm-zip/target/openidm-*.zip .zip); ver=${ver#openidm-}
+          # no "ls | grep -q": grep exits on the first match, ls dies of SIGPIPE and pipefail fails the step (141)
+          bundles=$(docker exec test ls /opt/openidm/bundle)
+          grep -q -- "-${ver}.jar" <<< "$bundles"
+      - name: Scan image for vulnerabilities (Trivy)
+        # trivy resolves the image from the local Docker daemon, so only the runner's
+        # linux/amd64 manifest is scanned; cache: false keeps the ~1GB trivy DBs from
+        # evicting the m2-repository caches out of the repo's 10GB actions-cache quota
+        continue-on-error: true # a trivy binary or DB download failure must not fail the docker test job
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: localhost:5000/${{ env.image_repository }}:${{ env.release_version }}-alpine
+          format: sarif
+          output: trivy-results.sarif
+          severity: CRITICAL,HIGH
+          limit-severities-for-sarif: true
+          ignore-unfixed: true
+          scanners: vuln
+          cache: false
+      - name: Upload Trivy report to GitHub Security
+        uses: github/codeql-action/upload-sarif@v4
+        continue-on-error: true
+        # upload even if a preceding step failed, but not without a report to upload
+        if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
+        with:
+          sarif_file: trivy-results.sarif
+          # distinct from the docker-scan.yml categories, which track the published images
+          category: trivy-build-alpine
diff --git a/.github/workflows/docker-scan.yml b/.github/workflows/docker-scan.yml
new file mode 100644
index 000000000..72fb0e876
--- /dev/null
+++ b/.github/workflows/docker-scan.yml
@@ -0,0 +1,60 @@
+# The contents of this file are subject to the terms of the Common Development and
+# Distribution License (the License). You may not use this file except in compliance with the
+# License.
+#
+# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+# specific language governing permission and limitations under the License.
+#
+# When distributing Covered Software, include this CDDL Header Notice in each file and include
+# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+# Header, with the fields enclosed by brackets [] replaced by your own identifying
+# information: "Portions copyright [year] [name of copyright owner]".
+#
+# Copyright 2026 3A Systems, LLC.
+
+# Scans the published Docker images for known vulnerabilities: new CVEs surface in
+# already-released images (mostly via the base image), without any change in this repository.
+name: Docker Scan
+
+on:
+  schedule:
+    - cron: '30 5 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    # Do not run the scheduled scan in forks; manual runs are always allowed.
+    if: github.event_name == 'workflow_dispatch' || github.repository == 'OpenIdentityPlatform/OpenIDM'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write
+    strategy:
+      fail-fast: false
+      matrix:
+        tag: [ 'latest', 'alpine' ]
+    steps:
+      - uses: actions/checkout@v6
+      - name: Scan openidentityplatform/openidm:${{ matrix.tag }} (Trivy)
+        # unlike the build.yml scan (ignore-unfixed: true), unfixed CVEs are reported too: surfacing them in
+        # already-released images is the point of this workflow; no platform is set, so
+        # only the linux/amd64 manifest of each multi-arch tag is scanned
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+        with:
+          image-ref: openidentityplatform/openidm:${{ matrix.tag }}
+          format: sarif
+          output: trivy-${{ matrix.tag }}.sarif
+          severity: CRITICAL,HIGH
+          limit-severities-for-sarif: true
+          scanners: vuln
+          cache: false
+      - name: Upload report to GitHub Security
+        uses: github/codeql-action/upload-sarif@v4
+        # upload even if a preceding step failed, but not without a report to upload
+        if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
+        with:
+          sarif_file: trivy-${{ matrix.tag }}.sarif
+          category: trivy-image-${{ matrix.tag }}