diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
index d8d65030f..399085c05 100644
--- a/.forgejo/workflows/ci.yml
+++ b/.forgejo/workflows/ci.yml
@@ -621,14 +621,17 @@ jobs:
 
             - name: Security scan Dockerfile.server image with Trivy
               run: |
-                  # Install Trivy at a pinned version with checksum verification
+                  # Install Trivy at a pinned version with checksum verification.
+                  # v0.58.0 is the first stable release after v0.57.0; v0.57.1 does
+                  # not exist as a Trivy release tag.
+                  set -euo pipefail
                   apk add --no-cache curl tar
-                  TRIVY_VERSION="0.57.1"
-                  ARCH="amd64"
+                  TRIVY_VERSION="0.58.0"
                   TRIVY_TARBALL="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
-                  curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/${TRIVY_TARBALL}" -o "/tmp/${TRIVY_TARBALL}"
-                  curl -fsSL "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
-                  cd /tmp && grep "${TRIVY_TARBALL}" trivy_checksums.txt | sha256sum -c
+                  TRIVY_BASE_URL="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}"
+                  curl -fsSL "${TRIVY_BASE_URL}/${TRIVY_TARBALL}" -o "/tmp/${TRIVY_TARBALL}"
+                  curl -fsSL "${TRIVY_BASE_URL}/trivy_${TRIVY_VERSION}_checksums.txt" -o /tmp/trivy_checksums.txt
+                  ( cd /tmp && grep " ${TRIVY_TARBALL}\$" trivy_checksums.txt | sha256sum -c - )
                   tar -xzf "/tmp/${TRIVY_TARBALL}" -C /usr/local/bin trivy
                   trivy --version