diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index b758533..be6a5f1 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -10,13 +10,12 @@ jobs:
       - name: environment
         run: |
           echo "arch: $(uname -m)"
-          echo "runner works"
 
       - name: run tests
         run: |
           python3 -c "assert 2 + 2 == 4; print('test passed')"
 
-      - name: build a docker image
+      - name: build image
         run: |
           cat > Dockerfile <<'DOCKER'
           FROM alpine:latest
@@ -24,4 +23,18 @@ jobs:
           CMD cat /where
           DOCKER
           docker build -t ci-demo:${GITHUB_SHA::7} .
-          docker run --rm ci-demo:${GITHUB_SHA::7}
+
+      - name: scan image for vulnerabilities
+        run: |
+          # trivy is on the host; the runner shares the host docker socket,
+          # so it can see the image we just built
+          docker run --rm \
+            -v /var/run/docker.sock:/var/run/docker.sock \
+            aquasec/trivy:latest image \
+            --quiet --scanners vuln --severity HIGH,CRITICAL \
+            --exit-code 1 \
+            ci-demo:${GITHUB_SHA::7}
+          echo "no HIGH or CRITICAL vulnerabilities - image approved"
+
+      - name: run it
+        run: docker run --rm ci-demo:${GITHUB_SHA::7}