diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index 399085c05..00f473a5b 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -621,27 +621,35 @@ jobs:
 
             - name: Security scan Dockerfile.server image with Trivy
               run: |
-                  # Install Trivy at a pinned version with checksum verification.
-                  # v0.58.0 is the first stable release after v0.57.0; v0.57.1 does
-                  # not exist as a Trivy release tag.
+                  # Run Trivy via the pinned upstream Docker image instead of
+                  # downloading the GitHub release tarball. The previous tarball
+                  # approach hit persistent 404s from this runner's network path
+                  # to github.com release assets (kubeconform on github.com works,
+                  # so it isn't a blanket block — the Trivy asset path is the
+                  # one that fails). Docker Hub access is already proven by the
+                  # preceding docker build steps in this same dind job, and
+                  # pulling a pinned tag yields a content-addressable manifest
+                  # digest — no separate checksum bookkeeping needed.
                   set -euo pipefail
-                  apk add --no-cache curl tar
-                  TRIVY_VERSION="0.58.0"
-                  TRIVY_TARBALL="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-                  TRIVY_BASE_URL="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}"
-                  curl -fsSL "${TRIVY_BASE_URL}/${TRIVY_TARBALL}" -o "/tmp/${TRIVY_TARBALL}"
-                  curl -fsSL "${TRIVY_BASE_URL}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
-                  ( cd /tmp && grep " ${TRIVY_TARBALL}\$" trivy_checksums.txt | sha256sum -c - )
-                  tar -xzf "/tmp/${TRIVY_TARBALL}" -C /usr/local/bin trivy
-                  trivy --version
+                  TRIVY_IMAGE="aquasec/trivy:0.58.0"
+                  docker pull "${TRIVY_IMAGE}"
 
-                  # Scan the Dockerfile.server image for vulnerabilities
-                  # Exit with non-zero status if HIGH or CRITICAL vulnerabilities are found
-                  trivy image --severity HIGH,CRITICAL --exit-code 1 cleveragents-server:test
+                  # Mount the dind docker socket so Trivy can inspect the
+                  # cleveragents-server:test image we just built. Fail the gate
+                  # on HIGH or CRITICAL findings.
+                  docker run --rm \
+                      -v /var/run/docker.sock:/var/run/docker.sock \
+                      "${TRIVY_IMAGE}" image \
+                      --severity HIGH,CRITICAL --exit-code 1 \
+                      cleveragents-server:test
 
-                  # Also generate a detailed report for visibility
+                  # Also surface a detailed (non-failing) report for visibility.
                   echo "=== Detailed Trivy Scan Report ==="
-                  trivy image --format table cleveragents-server:test || true
+                  docker run --rm \
+                      -v /var/run/docker.sock:/var/run/docker.sock \
+                      "${TRIVY_IMAGE}" image \
+                      --format table \
+                      cleveragents-server:test || true
 
     helm:
         needs: load-versions