diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 80737f5..7804326 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -57,6 +57,18 @@ jobs:
       - name: Container smoke test
         run: tests/smoke.sh ${{ env.IMAGE }}:ci
 
+      # ignore-unfixed: the debian:bookworm-slim base carries CVEs with no
+      # upstream fix yet; failing on those would block every build on
+      # findings nothing in this repo can act on. A fixable HIGH/CRITICAL
+      # finding still fails the build.
+      - name: Scan image for vulnerabilities
+        uses: aquasecurity/trivy-action@v0.36.0
+        with:
+          image-ref: ${{ env.IMAGE }}:ci
+          severity: HIGH,CRITICAL
+          ignore-unfixed: true
+          exit-code: '1'
+
   push:
     needs: [unit-test, test]
 
diff --git a/Dockerfile b/Dockerfile
index 5943cb8..df72a15 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -52,7 +52,11 @@ RUN python3 -c "import pathlib, site; \
 # Install app requirements
 WORKDIR /dsc
 COPY requirements.txt ./
-RUN pip install --no-cache-dir -r requirements.txt
+# venv creation bootstraps its own setuptools via ensurepip, which
+# requirements.txt does not cover. 66.1.1 carries CVE-2024-6345 and
+# CVE-2025-47273; 78.1.1 fixes both.
+RUN pip install --no-cache-dir --upgrade "setuptools>=78.1.1" && \
+    pip install --no-cache-dir -r requirements.txt
 
 # Copy app
 COPY dsc ./dsc/
diff --git a/IMPROVEMENTS.md b/IMPROVEMENTS.md
index 6e45f7b..aea6d8b 100644
--- a/IMPROVEMENTS.md
+++ b/IMPROVEMENTS.md
@@ -22,7 +22,12 @@ exploit scenarios are discussed in public issues.
   `seaf-cli` has no `--version` flag; use `seaf-cli --help` and assert the
   expected subcommands, and record the installed version from the package
   manager instead.
-- [ ] Scan the resulting image and review every high or critical finding.
+- [x] Scan the resulting image and review every high or critical finding. Of
+  67 HIGH/CRITICAL findings (`trivy image`), 65 are in `debian:bookworm-slim`
+  packages with no upstream fix yet; the CI scan uses `--ignore-unfixed` so it
+  fails only on findings this repo can act on. The other 2, both `setuptools`
+  (bundled by `ensurepip` in the venv, not from `requirements.txt`), had
+  fixes and are resolved: see `Dockerfile`.
 - [ ] Establish a stronger trust anchor for the AppImage than a self-derived
   checksum: an upstream digest or signature, or a verified artifact mirrored
   somewhere we control.
@@ -207,7 +212,10 @@ Acceptance criteria:
   Dependabot configuration covers `requirements.txt`, the Dockerfile base
   image, and the workflow actions. The Seafile AppImage is fetched by URL and
   checksum, so it still has to be bumped by hand.
-- [ ] Run dependency and image scans on pull requests and on a schedule.
+- [ ] Run dependency and image scans on pull requests and on a schedule. The
+  `test` job now runs the Trivy image scan on every pull request and on every
+  push to `master` or a tag (see P0), which covers new code; a scheduled run
+  to catch newly disclosed CVEs against unchanged code is still missing.
 
 Acceptance criteria: