diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index be6a5f1..cfb8807 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -19,6 +19,9 @@ jobs:
         run: |
           cat > Dockerfile <<'DOCKER'
           FROM alpine:latest
+          # the scan below failed until this line was added - patching the base
+          # image is the fix, not lowering the severity threshold
+          RUN apk --no-cache upgrade
           RUN echo "built on $(uname -m)" > /where
           CMD cat /where
           DOCKER